In this blog, we demonstrate how memory forensics and disk artifact analysis can help investigators recover cryptocurrency-related evidence even after attempts have been made to delete or conceal wallet data.

Cryptocurrency investigations often involve suspects who attempt to conceal financial activity through anonymity networks, privacy-focused cryptocurrencies, and anti-forensic techniques. However, even when attackers attempt to delete wallet data or uninstall applications, digital traces frequently remain in system memory.

This case study demonstrates how memory forensics can help investigators recover cryptocurrency-related evidence even after attempts to remove it. The analysis focuses on identifying wallet artifacts, transaction activity, and cryptocurrency conversion techniques through forensic examination of volatile memory.

Note:

The case study presented in this article is a fictional scenario created for research and educational purposes to demonstrate cryptocurrency forensic investigation techniques.

Case Study Overview

A suspect was arrested in connection with a ransomware investigation. During the seizure operation, investigators discovered that the suspect's laptop was powered on, allowing forensic analysts to perform both RAM acquisition and disk imaging.

Intelligence inputs suggested that the suspect frequently accessed darknet marketplaces, cryptocurrency swapping services and used privacy-focused cryptocurrencies, such as Monero for transactions.

Prior to the seizure, the suspect reportedly attempted to destroy evidence by:

• Deleting cryptocurrency seed phrases
• Using living-off-the-Land tools such as SDelete
• Uninstalling multiple cryptocurrency wallet applications

However, since the memory acquisition was performed shortly after these actions, investigators believed that volatile traces of wallet activity and transaction artifacts could still be recovered from RAM.

Evidence Seizure and Acquisition

During the forensic acquisition process, the following steps were performed:

System Condition

• System found powered ON

Evidence Acquisition

• RAM dump acquired using FTK Imager
• Disk image acquired using FTK Imager

System Specifications

The seized system had the following configuration:

• Operating System: Microsoft Windows 11
• Version: 10.0.22631 (Build 22631)
• RAM: 16 GB
• Storage: 1 TB

Forensic Tools Used

The investigation utilized multiple forensic tools to analyze both disk and memory artifacts.

Memory Analysis

• Volatility 3 (executed within SIFT Workstation)

Evidence Acquisition

• FTK Imager

Disk Artifact Analysis

• Tools developed by Eric Zimmerman

Cryptocurrency Transaction Flow

The investigation revealed a transaction flow designed to obscure the origin of ransomware proceeds.

Observed Financial Activity

• Ransom payments received as XMR
• Funds transferred to the suspect’s wallet
• Storage of Monero in the Monero GUI Wallet
• Conversion of XMR to ETH using ChangeNOW

This technique is commonly used to obfuscate financial transactions and hinder blockchain tracing.

Forensic Artifacts Examined

The following artifacts were analyzed during the investigation:

Memory Forensics Analysis

Process Enumeration

Using the PSLIST plugin in Volatility 3, investigators identified multiple cryptocurrency and privacy-related processes running on the system.

Notable processes included:

• Tor Browser
• Monero GUI Wallet
• Ledger Live
• SDelete utility

The presence of these applications suggested active cryptocurrency usage combined with privacy and anti-forensic measures.

Recovering Wallet Data from Memory

Investigators conducted process memory dumps of the identified wallet applications and extracted readable artifacts using strings and grep analysis. In this blog post, we demonstrate analysis of two key processes the Monero wallet and the Tor Browser, to identify potential use of swapping services or evidence of laundering activity.

Monero Wallet Process

String extraction from the Monero wallet process revealed transaction-related artifacts, including the Monero wallet address.

Tor Browser Process

Analysis of the Tor browser process memory revealed:

• Access to cryptocurrency swap services
• Transaction-related information

Investigators also discovered evidence of interaction with the cryptocurrency exchange service:

• ChangeNOW

Cryptocurrency Exchange Activity

Further analysis revealed that the suspect used ChangeNOW.io to convert Monero into Ethereum-based assets.

Recovered artifacts included:

• Monero address
• Exchange transaction identifiers
• Exchange URLs used during the swap process

These artifacts allowed investigators to reconstruct the suspect’s cryptocurrency conversion activity.

Evidence of Cryptocurrency Laundering

The forensic evidence suggests that the suspect attempted to conceal ransomware proceeds by converting funds across multiple cryptocurrencies.

The observed laundering technique included:

• Receiving ransom payments
• Converting funds between multiple cryptocurrencies
• Using privacy-focused cryptocurrency such as Monero
• Leveraging instant swap services
• Attempting to delete wallet artifacts using secure deletion tools

Despite these efforts, volatile memory artifacts allowed investigators to recover critical evidence.

Conclusion

This case study highlights the importance of memory forensics in cryptocurrency investigations. Even when suspects attempt to destroy evidence using secure deletion tools or uninstall wallet applications, traces of activity often remain in volatile memory.

By performing rapid acquisition and detailed forensic analysis, investigators can recover valuable evidence such as wallet addresses, exchange activity, and transaction artifacts. This helps reconstruct cryptocurrency-related activities even when attempts have been made to erase traces of operations.