Knowledge base
Preserving Evidence: Safe Handling of Old Wallets and Drives
The original file or drive is the only evidence that matters. Copy first, hash it, stop using the device, and never let an online tool near your wallet data.
Short answer
Most avoidable recovery failures happen before any search: the original is overwritten, renamed, re-saved or uploaded somewhere. Stop using the device or file immediately, and work only from copies or a disk image.
The first rules
- Make an exact copy before any analysis and never work on the original
- Record a SHA-256 hash of the original; a hash proves copies were not altered
- Note where and when you found the file: device, folder, backup, approximate date
- Do not rename files, change extensions, or open and re-save them in an editor
- Do not import an unknown file into random wallets 'to see what happens'
- Do not upload wallet files, seeds or keys to any online checker or 'recovery tool'
Old computers and drives
- Stop using the device immediately after a deletion: new writes can overwrite the data
- On a stable, readable drive, create a disk image before file-level work. If the drive is physically failing, stop using it and have it assessed before attempting a copy; repeated reads, including with dd or Clonezilla, can worsen the damage.
- Physical disk recovery is a separate specialty with its own labs; file-level tools are not the same
Malware and fake tools
- Download recovery tools only from official sources (official GitHub, official sites); search-ad links and forum mirrors are a standard malware route
- Fake 'wallet recovery', 'wallet checker' and 'password recovery' downloads exist for exactly this audience
- No legitimate tool ever asks you to enter a seed phrase into a website or upload a wallet file
- After recovery, move funds to a fresh wallet and never reuse the exposed key material
Haven’t regained access yet?
A first assessment costs nothing, and you won’t need to share any wallet secrets. Describe what you still have, and we’ll tell you honestly whether recovery is realistic. If the recovery doesn’t succeed, you don’t pay.