0

I am performing a forensics analysis of a Bitcoin Electrum wallet. When I open the file manually, there are values like this (changed it a bit):

"accounts": {
    "0": {
        "change": [
            "039de61d6f91d6e419641ef61d5df1f65d1fddddfd6fd1e84fe6fd1f1d6dfb5958", 
            "02f2ffe6f8d6df5df6e84f684fdf5416d1f6e8ef4964ffd3f3dfdfefe46f1d1f56", 
            "037bf6d541df651df3513df1d3f1d35fe6f4e6f4d5fd65fe65f1d3f1d3f1dea996", 
            "0266e5f1d651df6d1f6df1dfff6df51d65f1d65f1d6f46ef4ef65f1eff65e1fd3f", 
            "02651e65e1e1d1d6e1e5e1e6e6e6e6e65e1e1d31fd3f1d35df13d1f3d5fe216e71", 
            "036ef6d1f351d3f131df3df13d51f1d351fd35135151111131df35d1f3df13dcc2"
        ], 
        "receiving": [
            "03f6d41f6d51d31df3fe13f1d3521fd35fe5131ff1f11f133fd31fd35d1fd3f639", 
            "026e61fd6df1fd6fd6f16d1fdc6c1d6f1d6f1e61f8d4d6c1d65f6df1df1d3f5e14", 
            "03ef1dsdgsdgsg6f1d6d1c6d51fd651fed1c63d13fd13f1d32f1d3f31db5e8286a", 

...

I thought that these should be just addresses, but obviously they are not. It gets even stranger when I import the file into Electrum - it then automatically changes these values to addresses (in the file too). I don't think, that it's something like a private key - it's 66 chars long. Even if - when imported, Electrum still asks me for it. What does this all mean and how do I get information about transactions/addresses/amounts?

  • look in the keystore section for private key data. if you can extract that then you can restore your wallet with it and electrum will recreate the rest. – Abdussamad Oct 30 '18 at 10:00
0

The fields you are seeing are raw ECDSA public keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.