Find the file that holds your keys — before you do anything else.

Bitcoin Core (wallet.dat)

The classic Bitcoin wallet stores everything in a single wallet.dat file inside the Bitcoin data directory:

In older versions the file sat directly in the data directory (no wallets subfolder). Note the ~ means your user folder — on macOS, ~/Library is hidden by default (press Cmd+Shift+. in Finder or use Go → Go to Folder). A custom -datadir or -wallet flag moves it — check shortcuts and startup scripts. More in the wallet.dat guide.

Electrum

Electrum stores one wallet file per wallet, usually called default_wallet:

See Electrum wallet guide for the file format and what is recoverable.

Ethereum keystores (geth, MEW, MyCrypto, MetaMask vaults)

Ethereum “keystore” wallets are JSON files named like UTC--2026-01-15T12-34-56.789Z--<address>:

MetaMask is special: its encrypted vault lives inside the browser extension’s Local Storage (LevelDB), not as a JSON file you can see — so it is not an Ethereum-keystore-JSON case. With the seed phrase, restore the accounts derived from it (imported private-key/JSON accounts need their own backups); without it but with the encrypted vault still in the browser profile, offline password recovery may be possible. For real keystore JSON files, see Ethereum keystore guide.

Other wallets

Do not recognise your wallet? Use the which wallet file do you have? identifier — it walks you from clues to a shortlist of formats.

Your wallet was on a phone

Many wallet vaults only ever lived in a phone’s app storage — MetaMask mobile, Coinomi, imToken, Keplr, old Android wallets. If the phone still powers on, the vault may still be on it; if it doesn’t, the source is a backup. The full extraction walkthrough — ADB backups, encrypted iTunes/Finder backups, browser-extension vaults and the dead ends — is covered in get your wallet file off an old phone.

The headline in one line: phone app storage is the one place you can’t just browse — but a backup is usually the answer. No vault and no backup: there is nothing to attack.

Coinomi and Trust Wallet — the two most common phone-wallet questions

These two come up constantly, and the answer is different for each:

• Coinomi. The app password locks a scrypt vault — in Android app storage (com.coinomi.wallet) on phones, or as .wallet files in the Coinomi data directory on desktop. On Android it is not a file you can browse, so the realistic source is a device backup (ADB or full-device); on desktop, check the Coinomi data folder. Either way the vault is then cracked like any other wallet file. Coinomi guide · get the file off an old phone
• Trust Wallet. Traditional wallets are seed-based, so there is no wallet file — the phrase is the real path, and the app password stops mattering once you restore it. Trust Wallet SWIFT wallets are different: they use a passkey tied to your Apple/Google environment instead of a 12-word phrase, so identify the wallet model first. The one exception on the traditional path: the optional cloud backup (iCloud on iOS, Google Drive on Android) stores an encrypted copy of the phrase behind a password you set. If you forgot that password, there is no standard public crack tool for Trust Wallet’s backup format — treat it as a remember-the-password case, not a cracking case. seed phrase passphrase · rebuild the password from memory

How to search beyond the default folders

• Search by file name — wallet.dat, default_wallet, *.json, UTC--*, *.wallet, *.aes.json.
• Search by content — strings like encrypted_key, ciphertext, BIP38, or the JSON key "crypto" that marks Ethereum keystores.
• Check old backups — external drives, NAS shares, phone backups, Time Machine, Windows File History, cloud storage. The file from years ago is still valid.
• Check deleted-but-recoverable space — if the file was deleted, undelete tools or a specialist may still pull it back from the disk, as long as it was not overwritten. Do not keep using the drive.
• Recovered files need verification — copy them somewhere safe first, then verify with the original software before you rely on them.

If you find a file but do not know what kind it is, the how wallet encryption works page shows how to read its format markers — and the glossary explains the terms you will see.

Next steps

• Found a file? Read how wallet encryption works, then judge feasibility on when recovery is possible.
• Nothing found? Run where old passwords hide for non-file trails, and consider whether the wallet was seed-based — then the seed, or the passphrase on top of it, matters more than any file.
• Still unsure? The wallet identifier and first 24 hours plan keep you on track.

Sources & references

1. Bitcoin Wiki — data directory
2. Electrum — official wallet