{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,2]],"date-time":"2026-09-02T06:14:36Z","timestamp":1788329676773,"version":"build-2803163510"},"reference-count":31,"publisher":"Wiley","issue":"5","license":[{"start":{"date-parts":[[2026,5,5]],"date-time":"2026-05-05T00:00:00Z","timestamp":1777939200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"},{"start":{"date-parts":[[2026,5,5]],"date-time":"2026-05-05T00:00:00Z","timestamp":1777939200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Journal of Forensic Sciences"],"published-print":{"date-parts":[[2026,9]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The decentralized and pseudonymous nature of cryptocurrency has facilitated its extensive use in illicit activities, including money laundering, tax evasion, and ransomware. Limiting such activities requires a well\u2010established forensic framework. However, a dedicated methodology for examining cryptocurrency wallets remains underdeveloped. This study presents a systematic forensic analysis of Electrum wallets installed on virtual machines running Windows 10, outlining the wallet taxonomy and meticulously listing all artifacts. This study primarily focuses on memory forensics, with most of the analysis devoted to memory\u2010based artifacts extracted from five distinct memory dump scenarios. Artifacts extraction were performed using Volatility 3 plugins, in conjunction with Python\u2010based analysis scripts, within a Kali Linux environment. Following the memory\u2010based analysis, a limited disk examination was conducted after wallet inactivity or system shutdown to assess whether any residual Electrum artifacts persisted beyond memory. The research examines the artifacts retrievable from wallet files, both before and after backup, and compares these results with those obtained from other methods reported in the literature. The experimental outcomes demonstrate the impact of this research on the successful extraction of private keys, wallet addresses, extended public keys, wallet files, and transaction IDs. The extracted Electrum addresses and private keys provided access to critical wallet details, and unspent Bitcoin were successfully recovered using these keys, confirming the feasibility of forensic cryptocurrency recovery and revealing data of high evidentiary value to the digital forensic community.<\/jats:p>","DOI":"10.1111\/1556-4029.70357","type":"journal-article","created":{"date-parts":[[2026,5,6]],"date-time":"2026-05-06T06:10:47Z","timestamp":1778047847000},"page":"2051-2069","update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Cryptocurrency forensics: Forensic analysis of the Electrum wallet to uncover artifacts"],"prefix":"10.1111","volume":"71","author":[{"given":"Saloni","family":"Jain","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering (CSE) Indian Institute of Information Technology Pune  Pune India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bhupendra","family":"Singh","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering (CSE) Indian Institute of Information Technology Pune  Pune India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nitesh K.","family":"Bharadwaj","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering (CSE) National Institute of Technology Raipur  Raipur India"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"311","published-online":{"date-parts":[[2026,5,5]]},"reference":[{"key":"e_1_2_13_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.tele.2018.11.006"},{"key":"e_1_2_13_3_1","doi-asserted-by":"publisher","DOI":"10.3390\/jrfm10040017"},{"key":"e_1_2_13_4_1","unstructured":"NakamotoS.Bitcoin: A peer\u2010to\u2010peer electronic cash system.2008Accessed 15 Jun 2024.https:\/\/bitcoin.org\/bitcoin.pdf"},{"key":"e_1_2_13_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.bcra.2022.100067"},{"key":"e_1_2_13_6_1","doi-asserted-by":"crossref","unstructured":"MeiklejohnS PomaroleM JordanG LevchenkoK McCoyD VoelkerGM et\u00a0al.A fistful of bitcoins: Characterizing payments among men with no names.2013Proceedings of the 2013 Internet Measurement Conference; Barcelona Spain. New York NY: Association for Computing Machinery. 127\u2013140.https:\/\/doi.org\/10.1145\/2504730.2504747","DOI":"10.1145\/2504730.2504747"},{"key":"e_1_2_13_7_1","unstructured":"MontanezA.Investigation of cryptocurrency wallets on iOS and Android mobile devices for potential forensic artifacts. [Master's thesis]. Huntington WV: Marshall University2014."},{"key":"e_1_2_13_8_1","doi-asserted-by":"crossref","unstructured":"ZhengZ XieS DaiH ChenX WangH.An overview of blockchain technology: Architecture consensus and future trends.2017Proceedings of the IEEE International Congress on Big Data; Honolulu HI. Piscataway NJ: IEEE. 557\u2013564.https:\/\/doi.org\/10.1109\/BigDataCongress.2017.85","DOI":"10.1109\/BigDataCongress.2017.85"},{"key":"e_1_2_13_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2936094"},{"key":"e_1_2_13_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2020.200908"},{"key":"e_1_2_13_11_1","doi-asserted-by":"publisher","DOI":"10.1108\/JMLC\u201012\u20102017\u20100074"},{"key":"e_1_2_13_12_1","unstructured":"Chainalysis.Cryptocurrency scams\u2014including investment fraud Ponzi schemes and \u2018pig butchering\u2019\u2014accounted for at least $9.9\u2009billion in on\u2010chain inflows in 2024.2024Accessed 14 Mar 2026.https:\/\/www.chainalysis.com\/blog\/2024\u2010pig\u2010butchering\u2010scam\u2010revenue\u2010grows\u2010yoy\/"},{"key":"e_1_2_13_13_1","unstructured":"Electrum Wallet.Electrum wallet v4.5.5 executable download [software on the Internet].2024Accessed 15 Jun 2024.https:\/\/download.electrum.org\/4.5.5\/electrum\u20104.5.5\u2010setup.exe"},{"key":"e_1_2_13_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2759766"},{"key":"e_1_2_13_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/access.2019.2948774"},{"key":"e_1_2_13_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.08.029"},{"key":"e_1_2_13_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05487-8_3"},{"key":"e_1_2_13_18_1","unstructured":"Koval\u010d\u00edkT.Digital forensics of cryptocurrency wallets. [Master's thesis]. Brno Czechia: Masaryk University2022."},{"key":"e_1_2_13_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2022.301486"},{"key":"e_1_2_13_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2023.301576"},{"key":"e_1_2_13_21_1","unstructured":"RathodDM BoraseBG MannaF.Identification of digital artefacts for Bitcoin transactions performed through Electrum wallet [poster on the Internet].2023Accessed 15 Jun 2024.https:\/\/www.researchgate.net\/publication\/375516563_Identification_of_Digital_artefacts_for_Bitcoin_transaction_performed_through_Electrum_wallet_\u2010_Copy"},{"key":"e_1_2_13_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103392"},{"key":"e_1_2_13_23_1","unstructured":"Electrum.Electrum documentation.2024Accessed 15 May 2024.https:\/\/electrum.readthedocs.io\/en\/latest\/faq.html"},{"key":"e_1_2_13_24_1","unstructured":"DoranMD.A forensic look at Bitcoin cryptocurrency. Master's thesis. New Orleans LA: University of New Orleans2014."},{"key":"e_1_2_13_25_1","unstructured":"ErinleY KethepalliY FengY XuJ.SoK: design vulnerabilities and security measures of cryptocurrency wallets [preprint].2023arXiv: 2307.12874.https:\/\/arxiv.org\/abs\/2307.12874"},{"key":"e_1_2_13_26_1","unstructured":"Bitcoin.Bitcoin improvement proposal 0039 (BIP\u20100039).2024Accessed 25 Nov 2024.https:\/\/github.com\/bitcoin\/bips\/blob\/master\/bip\u20100039.mediawiki"},{"key":"e_1_2_13_27_1","first-page":"1","volume-title":"Blockchain for Cybersecurity in Cyber\u2010Physical Systems","author":"Nowroozi E","year":"2022"},{"key":"e_1_2_13_28_1","unstructured":"Bitcoin Core.Segregated witness wallet development guide.2024Accessed 25 Nov 2024.https:\/\/bitcoincore.org\/en\/segwit_wallet_dev\/"},{"key":"e_1_2_13_29_1","unstructured":"Bitcoin.org.Electrum \u2013 mobile \u2013 Android.2024Accessed 25 Nov 2024.https:\/\/bitcoin.org\/en\/wallets\/mobile\/android\/electrum\/"},{"key":"e_1_2_13_30_1","unstructured":"WalkerG.HD wallet extended keys.2025Accessed 25 Nov 2024.https:\/\/learnmeabitcoin.com\/technical\/keys\/hd\u2010wallets\/extended\u2010keys\/"},{"key":"e_1_2_13_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.fsidi.2020.301002"},{"key":"e_1_2_13_32_1","unstructured":"JainS.Python\u2010based extraction of cryptocurrency artefacts [software on the Internet].2025Accessed 29 Jan 2025.https:\/\/github.com\/SaloniWarrior\/PyScriptsElectrumArtifacts"}],"container-title":["Journal of Forensic Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/1556-4029.70357","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1111\/1556-4029.70357","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/1556-4029.70357","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,2]],"date-time":"2026-09-02T05:39:31Z","timestamp":1788327571000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1111\/1556-4029.70357"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,5]]},"references-count":31,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2026,9]]}},"alternative-id":["10.1111\/1556-4029.70357"],"URL":"https:\/\/doi.org\/10.1111\/1556-4029.70357","archive":["Portico"],"relation":{},"ISSN":["0022-1198","1556-4029"],"issn-type":[{"value":"0022-1198","type":"print"},{"value":"1556-4029","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,5]]},"assertion":[{"value":"2026-01-07","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-04-17","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-05-05","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}