What evidence may connect a wallet to a device?¶

Application data, keys, addresses, transaction artefacts and user activity can connect a wallet to an endpoint. Application presence alone does not prove key control or every displayed transaction.

Display and control are different¶

Wallet files, databases, keys, seed material, hardware connections, browser extensions, history and connected sites can evidence use. Messages, notifications, screenshots and copied addresses can link specific events. Watch-only, imported, synchronised, stale or deleted data can show activity without current control.

Preserve before interaction¶

Avoid unnecessary opening, updating or synchronisation, which can alter artefacts, expose network data or affect assets. Use proportionate forensic and specialist processes.

Look for address generation, signing, recovery and hardware interaction. Report application presence, address visibility, key possession and transaction control separately.