0

I am performing a forensics analysis of a Bitcoin Electrum wallet. When I open the file manually, there are values like this (changed it a bit):

"accounts": {
    "0": {
        "change": [
            "039de61d6f91d6e419641ef61d5df1f65d1fddddfd6fd1e84fe6fd1f1d6dfb5958", 
            "02f2ffe6f8d6df5df6e84f684fdf5416d1f6e8ef4964ffd3f3dfdfefe46f1d1f56", 
            "037bf6d541df651df3513df1d3f1d35fe6f4e6f4d5fd65fe65f1d3f1d3f1dea996", 
            "0266e5f1d651df6d1f6df1dfff6df51d65f1d65f1d6f46ef4ef65f1eff65e1fd3f", 
            "02651e65e1e1d1d6e1e5e1e6e6e6e6e65e1e1d31fd3f1d35df13d1f3d5fe216e71", 
            "036ef6d1f351d3f131df3df13d51f1d351fd35135151111131df35d1f3df13dcc2"
        ], 
        "receiving": [
            "03f6d41f6d51d31df3fe13f1d3521fd35fe5131ff1f11f133fd31fd35d1fd3f639", 
            "026e61fd6df1fd6fd6f16d1fdc6c1d6f1d6f1e61f8d4d6c1d65f6df1df1d3f5e14", 
            "03ef1dsdgsdgsg6f1d6d1c6d51fd651fed1c63d13fd13f1d32f1d3f31db5e8286a", 

...

I thought that these should be just addresses, but obviously they are not. It gets even stranger when I import the file into Electrum - it then automatically changes these values to addresses (in the file too). I don't think, that it's something like a private key - it's 66 chars long. Even if - when imported, Electrum still asks me for it. What does this all mean and how do I get information about transactions/addresses/amounts?

1
  • look in the keystore section for private key data. if you can extract that then you can restore your wallet with it and electrum will recreate the rest.
    – Abdussamad
    Oct 30, 2018 at 10:00

1 Answer 1

0

The fields you are seeing are raw ECDSA public keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.