Wallet Sleuth is a triage tool that aims to quickly identify user cryptocurrency addresses and transactions from a variety of wallet applications!

Wallet Sleuth requires three main inputs: Appdata, Output and Wallet Selection.

Appdata - The AppData directory of the user.

Output - The Output directory for CSV files containing identified addresses and log files.

Wallet Selection - Wallet applications to search for cryptocurrency addresses through.

After running, an information box will notify you when the search is complete. Any identified cryptocurrency addresses are displayed in the output window and a log file details actions and errors in the search.

Connected Hardware Wallet Detector - Check for previously connected Hardware Wallets such as Trezor or Ledger, amoung others.

Wallet Detector - Determine what wallets to scan for addresses on by identifying currently installed wallets.

• Atomic Wallet
• Bitcoin Core
• Bitget (Brave, Chrome) (Formerly Bitkeep)
• Brave Browser Wallet
• Exodus Wallet
• Guarda (Chrome)
• Ledger Live
• Litecoin Core
• MetaMask (Brave, Chrome, Edge)
• Opera Browser Wallet
• Phantom (Brave, Chrome)
• Wasabi Wallet

• Currently the wallet finder function is limited to wallets in the 'Default' browser user profile, but the address finder will check all profiles for the selected browser.
• Support for Windows OS only.
• Requires Python 3.8 or higher
• To parse Transaction IDs from the cache, the brotli extension is required.

REMEMBER TO CONFIRM YOU OWN FINDINGS!