Recovery CAT: A Digital Forensics Tool for Cryptocurrency Investigations

Abstract

The increasing use of the Internet and cyber capabilities by criminals have made digital forensics a critical component of criminal investigations and prosecution. Criminal networks were early adopters of the cryptocurrency ecosystem; however, forensics capabilities for cryptocurrency-related investigations have been lacking. While investigators may utilize a number of commercially available digital forensics tools to search for cryptocurrency-related evidence, these tools are inadequate for the task. This paper presents Recovery CAT, a cryptocurrency-specific forensics tool for finding cryptographic artifacts or cryptographic material(s) such as seed phrases, addresses, private keys, wallet applications, hardware wallet usage, exchange domains, etc.