Quote from: Cricktor on March 08, 2025, 02:45:31 PM

Quote from: Hristiyan99 on March 04, 2025, 09:26:12 PM

I have created an image of the disk!

Good approach. You create a forensic master image or your storage media, maybe better a second copy of it, too.

You only work on a copy of that master image! Basic idea is to not have to touch old storage media a lot or at all anymore. Any procedure must not alter the forensic master image copy. You should always be able to easily get back to your initial data without risk of data loss if you need to start from fresh.

What do you know about your initial image copy?

Is the filesystem corrupted or OK?

Do you have to deal with deleted files? How much activity was there on the filesystem once important files were deleted or corrupted?

You would need to provide more details about your specific situation to be able to give you better advise on tools to recover wallet files.

Hello,

Thank you for your response!

I have created an Image of the C - directory via DD function from Ubuntu live USB stick.

So far I have determined that there are not any bitcoin traces on the HDD which means that the PC have been re-installed and essentially the HDD formatted.
I would need to begin by searching the HDD for bitcoin software traces to confirm that mining activity has occurred.
Would you suggest to look for traces of Bitcoin software firstly, before looking straight for Wallet.dat file (harder to find)

I am looking for suggestions in software to begin searching for bitcoin software traces.