That depends on whether or not a password was used and/or whether or not full file encryption was used.
Electrum supports THREE different options:
1. Unencrypted (wallet is stored in plaintext)
- No password required
2. "Secrets only" encrypted (wallet is still plaintext, but the "secrets" (private keys/seeds etc) are encrypted)
- Wallet will open without the password, but password required to send transactions/view seed and private keys etc
3. Full file encryption
- Wallet will not even open without password
In any case, the file itself is just a simple text file... not sure you'll find a "standard" hex pattern that will guarantee identification of an Electrum wallet file.
In cases #1 & #2, a plaintext file search for: "wallet_type" should find those...
Electrum supports THREE different options:
1. Unencrypted (wallet is stored in plaintext)
- No password required
2. "Secrets only" encrypted (wallet is still plaintext, but the "secrets" (private keys/seeds etc) are encrypted)
- Wallet will open without the password, but password required to send transactions/view seed and private keys etc
3. Full file encryption
- Wallet will not even open without password
In any case, the file itself is just a simple text file... not sure you'll find a "standard" hex pattern that will guarantee identification of an Electrum wallet file.
In cases #1 & #2, a plaintext file search for: "wallet_type" should find those...
There is no hex pattern as its a hashed encrypted wallet. Only hint is that the hash ends with == so you could search for that
In case #3, I've some that end in == and some that end in = and some that don't... with only the = its very common pattern