Old devices with a possible wallet

Old computers, phones and external storage media can contain important evidence or access material: a laptop in a drawer, a phone that was “still charging somewhere”, an external drive or a USB stick. The machine is evidence and possibly the only route to the assets. Treat it accordingly.

Why old devices matter

Access to crypto often consists of several components: a wallet program, a file, a password, a logged-in session, or a seed phrase in a document. Old devices often still hold those components exactly as the owner left them. That “original image” is precisely what makes later examination possible, and why the device’s value can lie in its untouched state rather than its working condition.

What may be on the device

• Wallet software, desktop wallet applications, browser extensions, mobile wallet apps.
• Wallet files, files such as wallet.dat, keystore/JSON files, or app data folders that contain the key material.
• Backup files, exported backups, password-manager databases, or notes files with recovery words.
• Clues, browser history pointing to an exchange or wallet site, saved login pages, email drafts, screenshots of balances or QR codes.

How to handle the machine

• Do not switch it on unnecessarily, do not run updates, and do not connect it to the internet before you have a plan. Do not automatically change the power or network state: if the device is off, do not switch it on without a plan; if it is already on or potentially important for access, do not casually change settings, do not automatically enable airplane mode and do not switch the device off without care. First determine how the device can be safely isolated from networks while preserving its current state.
• Do not reset, reinstall or wipe anything. A factory reset is the single most destructive action for a crypto estate.
• Do not “try” passwords or PINs repeatedly; some devices slow down, lock, reset or wipe local data after several wrong attempts.
• Document what you see without recording secrets. Photograph the outside, the model, and (later) the file structure, never the words, keys or QR codes themselves.
• Keep the machine and its surroundings unchanged until the lawful representative decides what may be examined. See chain of custody.
• Keep the charger, cables and any SIM card with the device, and store everything somewhere dry and safe.

Copies and the forensic approach

When examination is needed, choose a method that leaves the original device as intact as possible. Which way of copying or reading out is suitable depends on the type of device.

What traces may be left

• Wallet programs and their files (wallet files or keystore files);
• browser extensions for wallets and their settings;
• documents with seed phrases or notes;
• email archives with exchange correspondence;
• password-manager entries;
• logged-in sessions on websites.

A finding is an indication; only after verification is there a verified digital or on-chain record of an account or wallet.

What to do with it

• Old computers and phones can contain wallet files, seeds, passwords and 2FA.
• When the estate is ready: a careful, documented examination can find and copy these files without altering them. Because a wrong step can change or lock the only copy, this is often best done with professional help, and never before authority is confirmed.
• The classic mistake: powering on, updating, syncing or opening wallet software without a plan: each can change data, metadata, application state or access options, and in some situations make recovery harder.
• If something was already opened or changed: do not try more (read you already made a mistake, what now?).
• Until authority is confirmed, preserve the device’s current state and avoid unnecessary changes: both powering off and leaving a device connected can affect data or access in certain situations, so have the appropriate preservation approach assessed before powering off, connecting, unlocking or changing anything. Do not unlock it carelessly.

Why you should not go digging alone

Opening wallet software, decrypting files or guessing credentials can alter or lock the only copy of the key material. Even reading a file can update its metadata or trigger a sync. The safe sequence is: preserve → identify → establish authority → only then, with a documented plan, examine. An old device found after a death is an inheritance question, not a computer-fix-it task, and it is not a reason to hand your secrets to anyone who contacts you offering to “scan” it.

For the index of the wallet formats covered in this library and its deep guide, see the wallet format library.