Extracting Files

When conducting a cryptocurrency investigation, one of the more important things to do is locate and recover the wallet address, if possible. The wallet will contain all the data you will need, including Bitcoin usage, private keys and addresses, records of transactions, and other metadata. A simple Google search can often locate the wallet file for a particular type of cryptocurrency software. We have examined some examples of the most popular software wallets in previous modules. However, with most software, the way you store your data can vary from wallet to wallet, and with many, you can choose your own installation location, so the default addresses that you can find in the software documentation may not be accurate.

The default wallet locations for the most popular wallet software programs are listed next. The list contains the name of the software, the operating system, the path to the wallet, and, if relevant, the wallet’s name in parentheses.

Bitcoin Core

  • Windows XP: C:\Documents and Settings\ \Application data\Bitcoin
  • Windows Vista through Windows 10: C:\Users\ \Appdata\Roaming\Bitcoin
  • Linux: ˜/.bitcoin/
  • Mac: ˜/Library/Application Support/Bitcoin

  • Linux: /home/ /.litecoin.conf
  • Mac: /Users// /Library/Application Support/litecoin.conf
  • Windows XP: c:\Documents and Settings\ \Application Data\Litecoin\litecoin.conf
  • Windows Vista through Windows 10: c:\Users\ \AppData\Roaming\Litecoin\litecoin.conf
  • Armory: %appdata%\Armory (.wallet)
  • Bitcoin Unlimited/Classic/XT/Core: %appdata%\Bitcoin (wallet.dat)
  • Bither: `%appdata%\Bither` (address.db)
  • Blockchain.info: (wallet.aes.json)
  • MultiBit HD: %appdata%\MultiBitHD (mbhd.wallet.aes)
  • Electrum:%appdata%\Electrum\wallets
  • mSIGNA: homedrive%%homepath (.vault)


Was this helpful?

Yes No
You indicated this topic was not helpful to you ...
Could you please leave a comment telling us why? Thank you!
Thanks for your feedback.

Post your comment on this topic.

Post Comment