I am performing a forensics analysis of a Bitcoin Electrum wallet. When I open the file manually, there are values like this (changed it a bit):
"accounts": {
"0": {
"change": [
"039de61d6f91d6e419641ef61d5df1f65d1fddddfd6fd1e84fe6fd1f1d6dfb5958",
"02f2ffe6f8d6df5df6e84f684fdf5416d1f6e8ef4964ffd3f3dfdfefe46f1d1f56",
"037bf6d541df651df3513df1d3f1d35fe6f4e6f4d5fd65fe65f1d3f1d3f1dea996",
"0266e5f1d651df6d1f6df1dfff6df51d65f1d65f1d6f46ef4ef65f1eff65e1fd3f",
"02651e65e1e1d1d6e1e5e1e6e6e6e6e65e1e1d31fd3f1d35df13d1f3d5fe216e71",
"036ef6d1f351d3f131df3df13d51f1d351fd35135151111131df35d1f3df13dcc2"
],
"receiving": [
"03f6d41f6d51d31df3fe13f1d3521fd35fe5131ff1f11f133fd31fd35d1fd3f639",
"026e61fd6df1fd6fd6f16d1fdc6c1d6f1d6f1e61f8d4d6c1d65f6df1df1d3f5e14",
"03ef1dsdgsdgsg6f1d6d1c6d51fd651fed1c63d13fd13f1d32f1d3f31db5e8286a",
...
I thought that these should be just addresses, but obviously they are not. It gets even stranger when I import the file into Electrum - it then automatically changes these values to addresses (in the file too). I don't think, that it's something like a private key - it's 66 chars long. Even if - when imported, Electrum still asks me for it. What does this all mean and how do I get information about transactions/addresses/amounts?
