A folder called “backup-final-2” is easy to dismiss. Its date and original computer may make it your best lead. Sort the backups before opening every file.
Which backups are worth searching?
- External HDDs and SSDs used for full-PC or file-history backups
- USB sticks used during a computer migration
- Copied Windows user-profile folders
Windows.olddirectories from an operating-system reinstall- OneDrive, Dropbox, Google Drive, and other synced folders
- ZIP, 7Z, and RAR archives named backup, old laptop, documents, profile, or crypto
- Exported browser profiles and application-data folders
- Phone photo backups that may contain screenshots of recovery instructions
Make a backup inventory before opening files
Create a simple list with the backup name, approximate date, source computer, Windows username, and storage location. This prevents repeated scanning and helps connect a finding to the period when you used a particular wallet. Dates matter: a 2014 laptop backup is more relevant to early Bitcoin Core or Electrum use than to a browser wallet introduced years later.
Search by artifact type
Wallet database files
Search for wallet.dat, Electrum wallet directories, wallet backups, and files located near known wallet application folders. A generic filename can still be important when its original folder structure is preserved.
Ethereum keystores
Look for JSON files containing encrypted keystore structures rather than assuming every JSON file is relevant. The Ethereum keystore guide explains the common clues and why these files still require the correct password.
Seed phrase and private-key clues
Text files, password-manager exports, PDFs, documents, and screenshots may contain recovery words or private-key material. These searches create false positives, so validation and context matter. Keep possible secrets offline and do not paste them into online tools.
Browser-wallet storage
A copied browser profile can retain extension storage even when no obvious wallet export exists. Preserve the entire profile structure. Copying only one random database file may remove the context needed to identify the extension and profile.
Be careful with compressed archives
Do not bulk-extract unknown archives directly onto your main system. Work in a controlled folder with enough free space, scan the archives for malware when appropriate, and preserve the original archive unchanged. Password-protected archives may themselves be wallet backups; record their names and dates even if you cannot open them immediately.
A practical search order
- Prioritize by date and device. Start with backups from the period when you acquired or used crypto.
- Preserve folder structure. Application-data paths can identify the wallet family.
- Run targeted filename searches. Check wallet files, keystores, exports, and wallet-specific folders.
- Scan readable backup roots. Use a local scanner to find cryptographic patterns and known wallet artifacts.
- Review high-confidence leads first. Do not waste time opening thousands of unrelated text and JSON files.
- Record what was searched. Note paths, dates, and results before moving to the next backup.
Scanning several backup drives
Technicians and users with many disks can queue up to 10 unique drives or folders in the CryptoTrace Technician workflow. Each target runs sequentially, which avoids hammering multiple old disks at once, and the final results combine findings, totals, errors, and reports. Home users can scan the same types of backups one target at a time.
All scanning remains local and read-only. CryptoTrace can identify likely wallet artifacts and recovery clues, but it cannot guarantee that a file contains funds or bypass a forgotten password.
What to do with a promising backup
- Copy the complete relevant folder, not only the highlighted file.
- Keep the original backup unchanged.
- Document the backup date, original computer, and Windows username.
- Identify the wallet software and version before importing anything.
- Use a clean environment for restoration and create a new secure wallet for recovered funds.
Backups turn a vague search into evidence
A backup does not need to be neatly labeled to be useful. Its date, folder structure, browser profile, and nearby files can reconstruct how you used crypto years ago. Search systematically, preserve the originals, and let each verified clue narrow the next step.