No file called “Phantom wallet” turns up on the old PC. That is unsurprising: start with the browser profiles and the recovery method you used when creating the wallet.
Finding those traces is valuable, but it is important to separate evidence of a wallet from a credential that can restore it. A browser profile may confirm which wallet was used and preserve encrypted local data. It does not automatically reveal a recovery phrase, private key, or usable balance.
What Phantom can leave on a Windows computer
- Extension files that identify Phantom as installed in a browser profile
- Encrypted extension storage and browser databases associated with that profile
- Multiple browser profiles, including profiles copied from an older computer
- Public wallet addresses in notes, transaction records, screenshots, or browser history
- Recovery instructions, password hints, or migration notes stored elsewhere on the disk
- Backups inside
Windows.old, cloud-sync folders, ZIP archives, or external drives
Phantom states that recovery phrases and private keys are stored locally in an encrypted vault. The password for the browser extension unlocks that vault on that device; it is not a substitute for the wallet’s recovery method. Never upload a copied browser profile or suspected vault to a recovery website.
Preserve the browser profile before opening it
Do not start by reinstalling Phantom, clearing browser data, resetting the extension, or signing into browser sync. Those actions can alter the profile you are trying to investigate. Copy the complete Windows user profile—or create a disk image when the drive is unstable—before experimenting.
Keep the original folder structure. Extension storage is spread across several browser databases and directories, so copying one interesting-looking file can remove the context needed to associate it with Phantom and the correct browser profile.
Where to search for Phantom evidence
- Inventory every Windows user. Check all folders beneath
Users, including old, renamed, and migrated accounts. - Identify every browser profile. Chrome, Edge, Brave, Firefox, and other Chromium-based browsers can each contain several profiles.
- Preserve extension-storage directories. Look for extension settings, Local Storage, IndexedDB, and profile databases without changing them.
- Search backups as well as the live profile. Check
Windows.old, copied AppData folders, cloud storage, external disks, and compressed archives. - Search supporting documents. Notes containing “Phantom,” “Solana,” public addresses, recovery wording, or password hints can explain which profile matters.
Identify the original recovery method
Check whether the wallet used a phrase, an imported key, a hardware device, or Google/Apple sign-in. For social sign-in, a PIN is required if your setup used one. Follow the current official instructions for that method; a restored app alone does not restore access.
Keep the browser password with the profile it belonged to. Its usefulness depends on the recovery method and surviving data. A public address identifies an account to investigate; check its transaction history separately. It does not, by itself, establish activity or permit spending.
A safe Phantom recovery workflow
- Make at least two copies of the relevant browser profile and record its original path.
- Work on a copy using a clean, trusted Windows environment.
- Confirm the browser, profile name, and Phantom installation before attempting access.
- Gather likely extension passwords, recovery notes, and the Google or Apple account used at the time.
- If access is restored, verify public addresses before moving anything.
- Move recovered assets to a newly secured wallet if the old profile or computer may have been exposed.
Phantom Support will not ask for your Secret Recovery Phrase or private key. Anyone requesting either credential can take control of the wallet.
How CryptoTrace helps with Phantom searches
CryptoTrace can scan old Windows profiles, mounted drives, and backups locally for browser-wallet storage, public addresses, private-key patterns, seed-phrase candidates, and related artifacts. Results are grouped into ranked Recovery Leads so that a probable Phantom profile is easier to distinguish from an unrelated browser database.
The scan remains read-only and local. CryptoTrace does not bypass Phantom encryption, recover a missing phrase, or guarantee access. Its role is to locate and organize the evidence needed for a legitimate recovery attempt while keeping sensitive files under your control.
The practical next step
If an old PC may have contained Phantom, preserve its browser profiles before changing anything. Search every user account and backup, establish how the wallet was originally created, and treat any possible recovery credential as highly sensitive. A careful profile-level search can turn “I used Phantom somewhere” into a specific, testable recovery path.
Continue with the MetaMask wallet-trace guide and the guide to finding seed phrase backups.