Help & User Guide

CryptoTrace: choose a workspace

1. Find wallets: choose a scan type and location, then Scan. Advanced keeps custom paths, Technician queues and case controls. Accounts shows supported local registration, deposit, withdrawal and purchase clues; email dates are not verified transaction times. Use the fixed official website shown by the next action, not links from old emails.

2. Check backup: choose one file for a read-only diagnostic check (64 MiB maximum; JSON metadata up to 2 MiB). Backup inspection and two-copy comparison are free. SHA-256 fingerprints show whether the bytes match. A supported supplied-password check returns diagnostics without displaying or saving recovered keys. Use Recover access for a password search.

3. Test known password appears only for supported Ethereum v3 PBKDF2-HMAC-SHA256/AES-128-CTR files with bounded parameters. It authenticates the MAC and opens the private-key payload in memory without displaying or saving it. The input is cleared. Wallet identity, funds and complete restoration remain unverified; Scrypt and Electrum/Core password checks are not supported.

4. Privacy check: drop one file or folder, or Browse → File/Folder, then Check files. Supported ZIP/DOCX text is read without extracting to disk. Recovery material, labelled API secrets/access tokens, supported password-export CSV schemas and private-key containers can be flagged without values. Correct a working copy yourself and recheck it.

5. Personal session history, saved checks and comparisons are free. Save a check locally and reopen it after restarting. Find filenames and locations stay masked until activation. Session history holds 20 unsaved scans; the latest 100 saved scans are displayed without deleting older files. Compare records New, Still present and Not seen, with scope/policy and coverage warnings. Not seen does not certify deletion, revocation or secure erasure.

6. Daily or weekly repeat checks are free for the location you choose in Privacy check. Keep the app open; a missed check runs after reopening when the app is idle. Off → Save disables it; Stop scan interrupts a running repeat check. It runs only while the app is open and keeps a local comparison baseline. Interactive scans take priority; no Windows task, service or autorun is installed.

7. Technician: Advanced → enter a case reference → Notes adds customer/report references and recorded recovery/handover steps. New-case notes save with the next scan; existing-case notes save immediately. The HTML report includes handover records. Do not type secrets in notes. Existing ten-source queues, named cases, forensic image candidates and encrypted .ctcase exports remain available.

8. Limits: local plain-text/EML/MBOX/HTML/CSV/JSON/Markdown exports are supported for account clues, not live inboxes, PST/OST, MIME/base64 decoding or native browser-history databases. Nested/encrypted archives, images, PDF/OCR and unsupported formats are not inspected. No source is modified, uploaded, sanitised or securely erased by these checks. Read Scan details before interpreting any result.

Search for deleted wallet material

Deleted wallets (Home/Technician): choose the drive and a private folder on another physical disk. Scan → Continue as administrator preserves both choices; then Scan. Physical-drive mode is the default; raw NTFS/MBR images are optional under Advanced. Supports 512-byte logical sectors, including 512e; 4Kn is unsupported. It reconstructs eligible deleted files and searches unallocated data for supported Ethereum/Electrum JSON, English BIP39 phrases and Bitcoin WIF keys. Reused, overwritten, erased, incomplete or unsupported data may be unrecoverable. Encryption is preserved. Passwords, wallet identity, restoration and funds are not verified. Outputs may contain secrets; keep them private. Stop retains complete files and a cancelled report. Read the coverage warnings. Trial requires activation before recovery starts.

Trial, Home and Technician

Trial has no scan-count or file-count quota. Find wallets completes the search and shows findings, with exact filenames and locations masked. Activate Home or Technician to reveal the same results without rescanning; trial reports and history keep Find locations masked.

Undelete wallets offers free read-only candidate previews with masked names and metadata. Preview writes no recovered files, folders or manifests. Activate Home or Technician to restore eligible files to another physical disk. Candidates do not guarantee recovery, access or funds.

Recover access offers free compatibility inspection and search estimates. Running password searches, saving protected recovery sessions and viewing recovered secret material require Home or Technician.

Free tools include backup inspection and comparison, one supplied-password diagnostic check, Privacy check with useful file locations, personal history and comparisons, ordinary JSON/HTML reports, and daily/weekly checks while the app is open. Public-address activity is free with explicit online consent. Find locations remain masked until activation.

Home is for one user's personal use. It unlocks exact Find locations, deleted-file restoration and supported password recovery, including protected sessions and recovered material. The free tools remain included.

Technician includes Home plus commercial work on customer machines, customer cases and notes, up to ten queued sources, forensic discovery and encrypted case packages.

Supported crypto and wallets

CryptoTrace currently looks for wallet files, wallet folders, addresses, private-key traces, browser-extension storage, and seed phrase backups for:

• Bitcoin family: Bitcoin, Litecoin, Dogecoin, Dash, Zcash, Bitcoin Cash, Electrum, Sparrow, Wasabi, Ledger Live, and Trezor Suite traces.
• Ethereum and EVM chains: Ethereum, Binance Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, MetaMask, Coinbase Wallet, Rabby, and OKX Wallet traces.
• Other major chains: Monero, XRP/Ripple, Cardano, Solana, Tron, Polkadot, and Kusama.
• Multi-coin wallets: Exodus and Atomic Wallet.
• Browser wallets: MetaMask, Phantom, TronLink, Coinbase Wallet, Rabby, OKX Wallet, Nami, Yoroi, Eternl, and Keplr-style extension storage paths where supported by the browser profile.
• Read supported NTFS drives and save eligible deleted files, seed phrases or keys to another physical disk. Home and Technician; recovery and funds are not guaranteed.

You have the wallet file, but the password is missing or uncertain. Recover access works from a preserved copy. Try a password you remember, or define a limited search from your own hints, such as words and variations you may have used. The work runs locally. Supported formats include Bitcoin Core legacy/descriptor wallets, Ethereum v3 PBKDF2/scrypt, standard Electrum encrypted JSON/BIE1 and complete direct MetaMask vaults. Eligible jobs can use a trusted Hashcat GPU backend; CPU fallback and independent CPU verification check the outcome. Protected sessions let you resume eligible work. Recover access offers free compatibility inspection and search estimates. Running password searches, saving protected recovery sessions and viewing recovered secret material require Home or Technician. Not every format variant is supported. A large search can take a long time and may find nothing. Use only wallets you are authorized to open.

Privacy note

Scanning is local and read-only. The trial may send minimal app-use analytics (anonymous install ID, app version, OS, timestamps), but scan contents, wallet contents, seed phrases, private keys, and file paths are not uploaded.

Quick start

• Choose a Scan Mode: Quick, Deep, Old drive / folder, or Browser extension.
• Optionally choose a Custom Path to scan one folder or exported browser profile.
• Press Start Scan. The Turbo pipeline scans folders and files with separate workers.
• Review ranked Recovery Leads first, then inspect raw findings by confidence.
• Trial has no scan-count or file-count quota. Find wallets completes the search and shows findings, with exact filenames and locations masked. Activate Home or Technician to reveal the same results without rescanning; trial reports and history keep Find locations masked. Free tools include backup inspection and comparison, one supplied-password diagnostic check, Privacy check with useful file locations, personal history and comparisons, ordinary JSON/HTML reports, and daily/weekly checks while the app is open. Public-address activity is free with explicit online consent. Find locations remain masked until activation.

Scan modes

• Quick: checks known wallet locations and common user folders.
• Deep: scans the Windows system more broadly with smart exclusions.
• Old drive / folder: scans the selected folder, or attached removable/non-system drives when no custom path is set.
• Browser extension: scans detected browser wallet storage folders or a selected browser profile.

Recovery Leads

• CryptoTrace groups related artifacts into scored recovery opportunities.
• Each lead includes likely wallet family, confidence, evidence count, and next action.
• Trial has no scan-count or file-count quota. Find wallets completes the search and shows findings, with exact filenames and locations masked. Activate Home or Technician to reveal the same results without rescanning; trial reports and history keep Find locations masked.

Privacy and licensing

• Scan contents, wallet contents, seed phrases, private keys, and file paths are not uploaded.
• Trial analytics may send anonymous install ID, app version, OS, and timestamps.
• Home / Technician uses a signed .lic file verified locally by the app.
• Copy Safe Summary excludes paths, seeds, private keys, and full tokens.

Still stuck? Email hello@crypto-trace.app.

App updates

The update checker compares the installed version locally with public release information. Startup checks are optional and disabled by default; if enabled, one check runs each time the app opens.

Manual checks, and startup checks if enabled, contact crypto-trace.app over HTTPS. The host receives your IP address and request metadata. No install ID, license, paths or scan contents are sent. Downloads and installation are manual.

Close to tray

Using the recovery tools

Understand verification, readiness, and coverage

1. Run the appropriate scan and review Recovery Leads before the raw findings. Bitcoin Core-family Berkeley DB and SQLite wallets, Ethereum keystores, and Electrum containers can now receive structural verification.
2. Read the readiness label, explanation, and next action. A verified container is stronger evidence, but it may still require the original password or recovery method.
3. Check Scan coverage. “Completed with coverage gaps” means some files were unreadable or only partly inspected; do not treat it as proof that no wallet exists.

Resume an interrupted or repeated scan

1. In Settings, leave “Reuse unchanged files on repeat scans” enabled. It is enabled by default.
2. After cancelling or interrupting a scan, select the same mode and target and start it again. CryptoTrace reuses completed work for unchanged files and scans changed files again.
3. Confirm “Resumed” and the reused-file count in the coverage panel. Use “Clear repeat-scan cache” in Settings when you intentionally want a fresh baseline.

Create and export a Technician case

1. With a Technician license, enter a customer or case reference before scanning. Use the + button to queue up to 10 different drives or folders for sequential scanning.
2. After the scan, the secret-free local snapshot appears under Recent cases. Select it and choose Open to review it later.
3. Choose Encrypted Case to export a .ctcase package. Use a password of at least 10 characters and store it separately—CryptoTrace cannot recover it.

Scan a forensic disk image

1. With a Technician license, select “Forensic disk-image scan,” choose Browse, and select one .img, .dd, .raw, or .bin image.
2. Start the scan. CryptoTrace uses a disk-safe profile and searches the image read-only for supported wallet signatures.
3. Treat carved signatures as candidates, not reconstructed wallet files. Preserve the original image and use the reported offset and next action for follow-up work.

Check public Bitcoin activity

1. A supported public Bitcoin address can be checked in Trial, Home or Technician. Choose Check public activity and read the consent prompt before sending that address to Blockstream.
2. Review the consent dialog. If approved, only that public address is sent to Blockstream’s Esplora service; wallet files, seeds, private keys, and local paths are not sent.
3. Use the returned transaction count and balance only as prioritization evidence. Public activity does not prove that you control the wallet.

On Windows, X minimizes CryptoTrace to the system tray after displaying an explanation. Select “Don’t show this message again” to remember your choice; you can re-enable the message in Settings. Scans can continue while the app runs. Click the tray icon to reopen CryptoTrace, or choose Exit from its menu to close it safely.