Purple computer monitor icon displaying binary code made of ones and zeros on a light background.

Conference/Workshop:
Advances in Digital Forensics XIX. DigitalForensics 2023.

Journal: IFIP Advances in Information and Communication Technology,

Published: 2023

Primary Author: Chen Shi

Secondary Authors: Yong Guan

Type: Conference Proceeding, Publication

Research Area: Digital

Crypto wallet apps that integrate with various block-chains allow the users to make digital currencies transaction with QR codes. According to reports from financesonline [3], there is over 68 million crypto wallet app users in 2021. As new crypto wallets and cryptocurrencies enter the market, the number of users will continue to go up in the future. As the market rapidly growing, it also raises concerns about security risks and sensitive information leakage. In this paper, we present our forensic analysis of Android cryptocurrency apps. As the popularity of cryptocurrency has increased significantly in the past few years, more and more people using mobile apps to make crypto transactions and manage their funds, the sensitive user information stored in such mobile apps has been increasingly discovered and adopted as critical evidence for civil and criminal cases. We have collected and analyzed 253 real-world Android cryptocurrency wallet apps. Our findings are surprisingly interesting: (1) 135 crypto wallet apps store user account information in a local file system which malware could potentially gain access to; (2) 67 crypto wallet apps access and store user’s location information in a local database and log files; (12) crypto wallet apps track the last used time of other application installed on the device. Our proposed approach found that, without recovering deleted files, various types of evidence data are still able to be identified from the logging system as well as files. We compare our analysis result with prior studies and find several types of evidence that were not discovered before. Our main contribution to this research is to provide an effective forensic analysis method for Android cryptocurrency wallet apps that can extract critical evidence from the local file system as well as system logs.

View Full Article

Related Resources

A thick gray wavy line forming an abstract, looping shape on a light gray background.

An Introduction to the Forensic Handwriting Analysis Software handwriter

July 18, 2025

Full Article

Blue shoeprint with a tread pattern on a white background.

Forensic Footwear: A Retrospective of the Development of the MANTIS Shoe Scanning System

July 10, 2025

There currently are no shoe-scanning devices developed in the United States that can operate in a real-world, variable-weather environment in …

Full Article

A green fingerprint icon on a light gray background.

Examiner consistency in perceptions of fingerprint minutia rarity

July 10, 2025

Friction ridge examiners (FREs) identify distinctive features (minutiae) in fingerprints and consider how rare these observed minutiae are in their …

Full Article