Encrypted drives and containers after death

Families clearing a home or estate sometimes find storage that cannot be opened: an encrypted USB drive, a container file, a disk that asks for a recovery key, or a password-protected archive. The encryption is not a problem by itself and says nothing by itself about the contents: many devices and systems encrypt by default. It does make the find potentially relevant. What matters for an estate is the same as for every other find: recognise it, preserve it, and never try to force it open.

What encrypted storage is

Encrypted storage protects its contents with a password, passphrase or recovery key. After a death, the important point is that the encryption is a layer around whatever is inside, often the wallet files, backups and documents that the estate needs. The medium itself is usually not the wallet; the wallet (or its backup) is what the encryption protects.

The types you are most likely to find

What it looks like	What it usually is	Your first step
A single file (often with a .hc extension) that opens as a drive when mounted	VeraCrypt or TrueCrypt container	Preserve the file; keep any written password securely and appropriately; note the software name and version
A hard drive, USB stick or partition that asks for a password when connected	VeraCrypt/TrueCrypt or LUKS encrypted volume	Preserve the medium; keep a found password securely and appropriately; note in the file only that a password exists and where it is kept securely
A Windows computer or drive that asks for a BitLocker recovery key	BitLocker-encrypted disk	Preserve the device and distinguish between the 48-digit recovery password (for example printed, saved as a text file, or stored in a Microsoft/Entra/AD account) and a separate recovery key (a .bek file on removable media); both are access material
A password-protected archive (.7z, .zip, .rar)	Encrypted archive, often holding documents or backups	Preserve the archive; keep any written password securely and appropriately; do not upload it anywhere
A backup file that asks for a password when opened	Encrypted backup, possibly from wallet or phone software	Preserve the file and the software name; keep a found password securely and appropriately
A password-vault database (for example KeePass .kdbx)	Encrypted password manager	Store the file and the master password securely and appropriately; note in the file only that access material exists and where it is. Access otherwise follows the same authority rules as the accounts themselves. See wallet passwords and passphrases

The exact file name and extension vary; do not identify by extension alone. The software installed on the same computer, the written notes nearby and any printed recovery key are the most reliable clues.

How it differs from a wallet file

• An encrypted keystore or wallet file (for example a UTC-- keystore or a wallet.dat) can contain key material or wallet configuration. A wallet.dat does not necessarily contain private keys; watch-only wallets also exist. Those have their own pages: Ethereum keystore and wallet.dat.
• An encrypted container or drive is a storage layer that may contain wallet files, backups, documents, or nothing crypto-related at all. Nobody can know without lawful examination.

If you are not sure which one you found, start at what did you find and treat everything as possibly sensitive until it is identified.

What to preserve

• The medium itself, exactly as found: the drive, USB stick, archive file or computer.
• Any written password, passphrase or recovery key: kept securely and appropriately, and never photographed or typed into any online service.
• The name and version of the encryption software, if visible (VeraCrypt, TrueCrypt, BitLocker, LUKS, 7-Zip and so on). The software version can matter as much as the password.
• A note of where it was found, by whom and when, see chain of custody.
• Do not put the secret in shared estate documentation by default. If it is needed for a technical examination, determine in advance who needs it and how it will be handed over safely.

What not to do

• Do not format, reinstall or “fix” the device, formatting destroys what the encryption protects.
• Do not mount the volume and then write to it, and do not let an operating system “repair” it.
• Do not work experimentally on the original medium; where appropriate, first make a controlled forensic copy and test passwords on a copy or suitable extraction. Changes to the original can affect evidence or recovery options. Do not attempt to decrypt before it has been assessed who is authorised for that action and on what basis; the authority and documentation required depend on the specific estate and circumstances.
• Do not upload the file to an online service that offers to “unlock” or “decrypt” it.
• Do not photograph or type any written password into an app, message or website.

Which access material is needed

Which access material is needed depends on the encryption system and the original configuration. A password can be enough, but recovery keys, keyfiles or other recovery mechanisms may also exist. An encrypted volume without the right access material cannot be opened by the estate’s documents alone. If a written password or recovery key is found, the medium, access material and software version together can restore access. If it is missing, some cases can be assessed technically and some cannot, nobody can know which without examining the exact situation. Read what is realistically possible in wallet recovery, and never pay anyone who guarantees an unlock before seeing the material.

What happens next

1. Record the find in the estate inventory, facts only, never the password.
2. Confirm legal authority before anything is opened, see legal authority vs technical access.
3. Understand the password and passphrase rules: see wallet passwords and passphrases.

What this page is not

This page is identification and preservation guidance. It contains no tools, no “unlock” services and no instructions for decrypting anything: opening an encrypted volume belongs to the estate process, after authority is confirmed, using the owner’s own password or a verified professional.

For the index of the wallet formats covered in this library and its deep guide, see the wallet format library.

For how storage methods compare for owners planning ahead, see crypto storage methods compared.