Title: Unveiling Bitcoin transactions: a forensic framework beyond predefined artefacts

Authors: Borase Bhushan Gulabrao; Digvijaysinh Rathod; Nitin Sharma; Aishwarya Tiwari

Addresses: School of Doctoral Studies and Research, National Forensic Sciences University, Gandhinagar, Gujarat, India ' School of Cyber Security and Digital Forensics, National Forensic Sciences University, Gandhinagar, Gujarat, India ' Centre for Development of Advanced Computing (CDAC), Hyderabad, India ' Centre for Development of Advanced Computing (CDAC), Hyderabad, India

Abstract: This research presents a novel approach to Bitcoin forensics that transcends the limitations of predefined digital artefacts. This research delves into RAM and disk analysis associated with various Bitcoin wallet types. These wallets are studied on eight different parameters. The methodology includes structured and unstructured RAM analysis and disk analysis. This approach focuses beyond pre-defined artefacts and yields a comprehensive list of 33 digital artefacts linked to Bitcoin activities. Additionally, it identifies 46 crucial keywords that can empower LEAs to detect artefacts in seized digital devices. This research offers significant advancements in the field. The identified artefacts provide valuable insights into Bitcoin transactions, and the keywords serve as powerful tools for investigators. In conclusion, this study presents a groundbreaking framework for Bitcoin forensics. The study offers a more robust methodology for uncovering evidence of Bitcoin transactions. This research can significantly enhance investigative capabilities in the ever-evolving realm of cryptocurrency crime.

Keywords: Exodus; Electrum; ledger; OKX; public key; private key; passphrase; Trezor.

DOI: 10.1504/IJESDF.2026.155005

International Journal of Electronic Security and Digital Forensics, 2026 Vol.18 No.4, pp.385 - 406

Received: 20 May 2024
Accepted: 19 Aug 2024
Published online: 22 Jul 2026 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article