Quote from: HCP on Today at 08:04:18 PM

That depends on whether or not a password was used and/or whether or not full file encryption was used.

Electrum supports THREE different options:

1. Unencrypted (wallet is stored in plaintext)
  - No password required

2. "Secrets only" encrypted (wallet is still plaintext, but the "secrets" (private keys/seeds etc) are encrypted)
  - Wallet will open without the password, but password required to send transactions/view seed and private keys etc

3. Full file encryption
  - Wallet will not even open without password

In any case, the file itself is just a simple text file... not sure you'll find a "standard" hex pattern that will guarantee identification of an Electrum wallet file.

In cases #1 & #2, a plaintext file search for: "wallet_type" should find those...

Quote from: keychainX on Today at 04:56:17 PM

There is no hex pattern as its a hashed encrypted wallet. Only hint is that the hash ends with == so you could search for that

In case #3, I've some that end in == and some that end in = and some that don't... Undecided

with only the = its very common pattern