Bitcoin Artifacts
 
Notifications
Clear all

Bitcoin Artifacts

5 Posts
4 Users
0 Likes
712 Views
Gordonk66
(@gordonk66)
Posts: 2
New Member
Topic starter
 

I am conducting a forensic examination on a computer that involves trying to find evidence relating to Bitcoin. I have located the Bitcoin wallet under app data/roaming and there is a wallet listed. I can only view in hex. It looks to me like it's encrypted, however I've been told by others that the wallet is not and that I should be able to locate the key which is supposed to be X amount of digits long and beginning with 2 known characters.

Any thoughts or ideas on how to find this or if anyone has had any experience with this.

I am running FTK V5.3.6 on this case as it's an older case.

Thanks

 
Posted : 15/03/2018 7:20 pm
Novunix
(@novunix)
Posts: 35
Eminent Member
 

I'd start here

 
Posted : 15/03/2018 7:52 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

Belkasoft supports analysis Bitcoin artefacts.

 
Posted : 16/03/2018 7:34 am
chad131
(@chad131)
Posts: 64
Trusted Member
 

Honestly. The easiest way is to download the wallet software. Launch it. Close it. Replace the wallet file and then re-open. Let it sync blocks if necessary. You can view balance, wallet address, and transaction history from the GUI much easier.

Most of the wallets allow you to set the directory of the blockchain and data from the command line. something like "bitcoin-qt.exe -datadir=./data/"

 
Posted : 16/03/2018 2:22 pm
Gordonk66
(@gordonk66)
Posts: 2
New Member
Topic starter
 

I'd start here

Great article, thanks

 
Posted : 16/03/2018 2:55 pm
Share:
Share to...