Carve deleted wallet files

PhotoRec scans a disk or image for wallet signatures byte-by-byte. Use a read-only source whenever possible.

1. Choose source

2. Output directory

Recovered files will be written here

Must be on a different drive than the source to avoid overwriting evidence.

3. Signature set

CryptoSalvage writes a custom photorec.sig targeting wallet.dat, Electrum, Ethereum keystore, and MetaMask vault blobs.

Generated command

photorec /d ~/Recovered /cmd /dev/disk0 options,paranoid,partition_none,fileopt,everything,disable,signatures,enable,search

~/.photorec.sig

# CryptoSalvage signature set for wallet recovery
# Format: extension offset hex-magic

# Bitcoin Core wallet.dat (Berkeley DB hash, magic 0x00053162 big-endian)
wallet  12  0x00 0x05 0x31 0x62

# Electrum JSON wallet
electrum 0  "wallet_type"

# Ethereum / MyEtherWallet keystore (scrypt KDF marker)
keystore 0  "\"kdf\":\"scrypt\""

# MetaMask vault blob (encrypted JSON with iv, salt, data)
mmvault  0  "\"iv\":"