Just looking at my phone there are 3 ways for a device to connect to the 'hotspot' phone, WiFi, Bluetooth and via USB (assuming a computer wants to use the iPhone connection).
Have you checked the records PA reports under the Wifi and Bluetooth sections?
I'm just about to do a test with my iPad and iPhone to see if anything is recorded there as my thinking is there may not be a seperate place for hotspot logs because the phone may simply see them as just another wifi or bluetooth connection.
The bad news is that if it is stored there it doesn't seem to report anything more than the device name and mac address. There may be plist files or other logs files with more information but nothing that I've been able to dig up at this point.
Edit: Connecting via bluetooth to the hotspot left my iPad name and Mac address in the bluetooth devices field that UFED can find, connecting via WiFi didn't leave any footprint in the wireless networks are that UFED extracts (which is not unexpected). I'm parsed the .tar download with Xways and was able to locate my iPad mac listed, however as Xways doesn't decode the UFED download correctly the text surrounding the mac address is junk.
It's nearly 5pm on a Friday so that's all the testing I've got time for right now as bourbon is calling me. Let me know if you find out anything further as this would be an interesting one.
↧