The crypto preservation checklist

Preservation comes before identification, before authority, before anything. One wrong action can destroy access or seriously weaken the security of the recovery material: resets, wipes or certain wrong attempts can affect access options, while photographing, uploading or sending a seed phrase can expose the secret to third parties. These are the rules in full.

PDF: Download the one-page first-48-hours checklist.

Do now

• Do not use, open or modify found devices and material unnecessarily. If moving something is necessary to prevent loss, damage or unauthorised access, record where and how it was found and move it carefully to a safe place.
• Note where each item was found, by whom, and when (this becomes the evidence record).
• Keep original packaging, cables and accessories with hardware wallets.
• Keep devices off networks where possible and do not update them. Do not change the power or network state unnecessarily: if a device is powered on and possibly important, have the appropriate preservation method assessed before powering it off, unlocking it or connecting it.
• Put paper notes, metal plates and documents somewhere safe, dry and private.

Preserve devices and media

• Do not guess PINs: some hardware wallets reset or wipe after repeated wrong attempts; the behaviour differs by brand, model and security version.
• Do not factory-reset, reinstall or wipe anything.
• Do not photograph, scan or type recovery words anywhere. Enter it only within a pre-verified and suitable recovery environment: compatible wallet software or hardware from a trusted official channel, or a controlled offline environment when specialist recovery is needed.
• Keep working copies of wallet files on the original medium; make a verified copy only under forensically careful conditions.
• Do not open, decrypt or “explore” encrypted files, see encrypted drives and containers.
• Leave the device as far as possible in its current state. Powering off can destroy volatile data, but an active device can also be changed or wiped remotely; have the appropriate approach assessed before intervening. A wiped device can destroy important local data, but recovery may sometimes still be possible through a valid wallet backup or recovery phrase.

Document, without secrets

• An inventory of what exists: devices, accounts, files, notes, locations.
• A record of who handled what and when (chain of custody).
• Never write seed phrases, private keys or passwords into estate documents or logs; keep any necessary recovery material securely and appropriately, according to your backup method.
• Record the classification of each finding: fact, inference or assumption.

What never to do

• Never share secret access material without a clear reason, not by email, form, message or phone.
• Never enter recovery words into a “verification” tool, and never anywhere just because a website or app looks official. Never enter a recovery phrase into a form or unknown app, and do not routinely type a hardware-wallet seed into a computer or phone. For normal recovery, follow the official procedure for the wallet or device concerned; with hardware wallets, recovery words are preferably entered directly on the trusted device, while other wallets may use an official app, software environment or web recovery procedure. Specialist or legacy recovery may require a different, controlled offline approach.
• A request to pay extra money to “unlock” or “release” funds is an important warning sign. Network or gas fees, and costs for unstaking or withdrawing, can occur in a genuine transaction. Always verify such costs through the official website, app or wallet, and do not pay to a random address someone sends you by message.
• Never act on pressure: a demand for immediate action is a warning sign, not an official process.
• Never log into the accounts of the person who passed away without established authority.
• Never share the seed phrase to “prove” anything: an official estate process does not ask for it. For specialist technical recovery, specific material may be needed, but only through a previously agreed written, secure process.

Why preservation is the whole job at first

Start safe evidence and material preservation immediately. In addition, assess whether legal, tax, platform or security matters require urgent action; the condition of the devices and the security of the secrets always require careful handling. Preservation is not a delay to be rushed through, it is what makes every later step possible. Access to crypto usually requires several components (device, PIN, seed phrase, possibly a passphrase, the right software version), and a single careless action can destroy one irreversibly. The device side is covered in old computer or phone with a wallet. Why access can still fail, and the most common causes, is covered in the most common reasons crypto can become unreachable.

Verify before any technical work

Before any specialist is involved: confirm the identity of the person or company, confirm what they will do, what they will never ask for, and that authority documents are in place.

If you need to know which help fits which situation, and how to verify anyone you contact, see who can help with inherited crypto.