Knowledge base
Preserving Evidence: Safe Handling of Old Wallets and Drives
The original file or drive is the only evidence that matters. Copy first, hash it, stop using the device - and never let an online tool near your wallet data.
Short answer
Most avoidable recovery failures happen before any search: the original is overwritten, renamed, re-saved or uploaded somewhere. Stop using the device or file immediately, and work only from copies or a disk image.
Most avoidable recovery failures happen before any search: the original was overwritten, renamed, re-saved or uploaded somewhere. Stop using it and make a copy before anything else: every rule below follows from that one step.
The first rules
- Make an exact copy before any analysis and never work on the original
- Record a SHA-256 hash of the original; a hash proves copies were not altered
- Note where and when you found the file: device, folder, backup, approximate date
- Do not rename files, change extensions, or open and re-save them in an editor
- Do not import an unknown file into random wallets 'to see what happens'
- Do not upload wallet files, seeds or keys to any online checker or 'recovery tool'
Old computers and drives
- Stop using the device immediately after a deletion: new writes can overwrite the data
- On a stable, readable drive, create a disk image before file-level work. If the drive is physically failing, stop using it and have it assessed before attempting a copy; repeated reads, including with dd or Clonezilla, can worsen the damage.
- Physical disk recovery is a separate specialty with its own labs; file-level tools are not the same
Malware and fake tools
- Download recovery tools only from official sources (official GitHub, official sites); search-ad links and forum mirrors are a standard malware route
- Fake 'wallet recovery', 'wallet checker' and 'password recovery' downloads exist for exactly this audience
- No legitimate tool ever asks you to enter a seed phrase into a website or upload a wallet file
- After recovery, move funds to a fresh wallet and never reuse the exposed key material
Still locked out?
The first assessment is free, and it asks for no wallet secrets. Describe what you still have — a file, a phrase, a device, or what you remember — and we’ll tell you whether recovery is realistic. You only pay if the recovery succeeds.