Extracting cont.

Extracting Files

When conducting a cryptocurrency investigation, one of the more important things to do is locate and recover the wallet address, if possible. The wallet will contain all the data you will need, including Bitcoin usage, private keys and addresses, records of transactions, and other metadata. A simple Google search can often locate the wallet file for a particular type of cryptocurrency software. We have examined some examples of the most popular software wallets in previous modules. However, with most software, the way you store your data can vary from wallet to wallet, and with many, you can choose your own installation location, so the default addresses that you can find in the software documentation may not be accurate.

The default wallet locations for the most popular wallet software programs are listed next. The list contains the name of the software, the operating system, the path to the wallet, and, if relevant, the wallet’s name in parentheses.

Bitcoin Core

• Windows XP: C:\Documents and Settings\ \Application data\Bitcoin
• Windows Vista through Windows 10: C:\Users\ \Appdata\Roaming\Bitcoin
• Linux: ˜/.bitcoin/
• Mac: ˜/Library/Application Support/Bitcoin
  

• Linux: /home/ /.litecoin.conf
• Mac: /Users// /Library/Application Support/litecoin.conf
• Windows XP: c:\Documents and Settings\ \Application Data\Litecoin\litecoin.conf
• Windows Vista through Windows 10: c:\Users\ \AppData\Roaming\Litecoin\litecoin.conf
• Armory: %appdata%\Armory (.wallet)
• Bitcoin Unlimited/Classic/XT/Core: %appdata%\Bitcoin (wallet.dat)
• Bither: `%appdata%\Bither` (address.db)
• Blockchain.info: (wallet.aes.json)
• MultiBit HD: %appdata%\MultiBitHD (mbhd.wallet.aes)
• Electrum:%appdata%\Electrum\wallets
• mSIGNA: homedrive%%homepath (.vault)