Old devices with a possible wallet

Most cryptocurrency found in an estate is found on old hardware: a laptop in a drawer, a phone that was “still charging somewhere”, an external drive or a USB stick. The machine is evidence and possibly the only route to the assets. Treat it accordingly.

Why old devices matter

Access to crypto often consists of several components: a wallet program, a file, a password, a logged-in session, or a seed phrase in a document. Old devices often still hold those components exactly as the owner left them. That “original image” is precisely what makes later examination possible, and why the device’s value can lie in its untouched state rather than its working condition.

What may be on the device

• Wallet software, desktop wallet applications, browser extensions, mobile wallet apps.
• Wallet files, files such as wallet.dat, keystore/JSON files, or app data folders that contain the key material.
• Backup files, exported backups, password-manager databases, or notes files with recovery words.
• Clues, browser history pointing to an exchange or wallet site, saved login pages, email drafts, screenshots of balances or QR codes.

How to handle the machine

• Do not switch it on unnecessarily, do not run updates, and do not connect it to the internet before you have a plan. Put the device in aeroplane mode or remove the network connection where possible.
• Do not reset, reinstall or wipe anything. A factory reset is the single most destructive action for a crypto estate.
• Do not “try” passwords or PINs repeatedly, devices lock after a few attempts.
• Document what you see without recording secrets. Photograph the outside, the model, and (later) the file structure, never the words, keys or QR codes themselves.
• Keep the machine and its surroundings unchanged until the lawful representative decides what may be examined. See chain of custody.
• Keep the charger, cables and any SIM card with the device, and store everything somewhere dry and safe.

Copies and the forensic approach

When examination is genuinely needed, the preferred method is a read-only image of the drive, made in a technically sound way and under supervision. The original stays intact; wallet files, documents and applications can be identified on the copy without modifying the original. Whether such a copy is needed is decided per case, it is not an automatic step.

What traces may be left

• Wallet programs and their files (wallet files or keystore files);
• browser extensions for wallets and their settings;
• documents with seed phrases or notes;
• email archives with exchange correspondence;
• password-manager entries;
• logged-in sessions on websites.

A finding is an indication; only after verification is it a confirmed account or wallet.

What to do with it

• Old computers and phones are the most likely place for wallet files, seeds, passwords and 2FA.
• When the estate is ready: a careful, documented examination can find and copy these files without altering them. Because a wrong step can change or lock the only copy, this is often best done with professional help, and never before authority is confirmed.
• The classic mistake: powering on, updating, syncing or opening wallet software: each can overwrite or lock the only copy of the key material.
• If something was already opened or changed: do not try more (read you already made a mistake) what now?.
• Until authority is confirmed, keep the device off networks and do not charge or unlock it carelessly.

Why you should not go digging alone

Opening wallet software, decrypting files or guessing credentials can alter or lock the only copy of the key material. Even reading a file can update its metadata or trigger a sync. The safe sequence is: preserve → identify → establish authority → only then, with a documented plan, examine. An old device found after a death is an inheritance question, not a computer-fix-it task, and it is not a reason to hand your secrets to anyone who contacts you offering to “scan” it.

For the full index of every wallet format and its deep guide, see the wallet format library.