<p>The fields you are seeing are raw ECDSA public keys. </p>

CC BY-SA 4.0
2018-10-26T07:44:36.703Z
2018-10-26T08:00:10.447Z
2018-10-26T08:00:10.447Z
Claris
<p>I am performing a forensics analysis of a Bitcoin Electrum wallet. When I open the file manually, there are values like this (changed it a bit):
<code></p>

<pre><code>"accounts": {
    "0": {
        "change": [
            "039de61d6f91d6e419641ef61d5df1f65d1fddddfd6fd1e84fe6fd1f1d6dfb5958", 
            "02f2ffe6f8d6df5df6e84f684fdf5416d1f6e8ef4964ffd3f3dfdfefe46f1d1f56", 
            "037bf6d541df651df3513df1d3f1d35fe6f4e6f4d5fd65fe65f1d3f1d3f1dea996", 
            "0266e5f1d651df6d1f6df1dfff6df51d65f1d65f1d6f46ef4ef65f1eff65e1fd3f", 
            "02651e65e1e1d1d6e1e5e1e6e6e6e6e65e1e1d31fd3f1d35df13d1f3d5fe216e71", 
            "036ef6d1f351d3f131df3df13d51f1d351fd35135151111131df35d1f3df13dcc2"
        ], 
        "receiving": [
            "03f6d41f6d51d31df3fe13f1d3521fd35fe5131ff1f11f133fd31fd35d1fd3f639", 
            "026e61fd6df1fd6fd6f16d1fdc6c1d6f1d6f1e61f8d4d6c1d65f6df1df1d3f5e14", 
            "03ef1dsdgsdgsg6f1d6d1c6d51fd651fed1c63d13fd13f1d32f1d3f31db5e8286a", 
</code></pre>

<p>...
</code></p>

<p>I thought that these should be just addresses, but obviously they are not. It gets even stranger when I import the file into Electrum - it then automatically changes these values to addresses (in the file too). I don't think, that it's something like a private key - it's 66 chars long. Even if - when imported, Electrum still asks me for it.
<strong>What does this all mean and how do I get information about transactions/addresses/amounts?</strong></p>

CC BY-SA 4.0
2018-10-30T10:00:15.393Z
look in the keystore section for private key data. if you can extract that then you can restore your wallet with it and electrum will recreate the rest.
Abdussamad
<wallet><electrum>
Strange values in Bitcon Electrum wallet file (change and receiving)
Johny
# Strange values in Bitcon Electrum wallet file (change and receiving)

(Asked by: username_0 on 2018-10-26)

I am performing a forensics analysis of a Bitcoin Electrum wallet. When I open the file manually, there are values like this (changed it a bit):

```
"accounts": {
    "0": {
        "change": [
            "039de61d6f91d6e419641ef61d5df1f65d1fddddfd6fd1e84fe6fd1f1d6dfb5958", 
            "02f2ffe6f8d6df5df6e84f684fdf5416d1f6e8ef4964ffd3f3dfdfefe46f1d1f56", 
            "037bf6d541df651df3513df1d3f1d35fe6f4e6f4d5fd65fe65f1d3f1d3f1dea996", 
            "0266e5f1d651df6d1f6df1dfff6df51d65f1d65f1d6f46ef4ef65f1eff65e1fd3f", 
            "02651e65e1e1d1d6e1e5e1e6e6e6e6e65e1e1d31fd3f1d35df13d1f3d5fe216e71", 
            "036ef6d1f351d3f131df3df13d51f1d351fd35135151111131df35d1f3df13dcc2"
        ], 
        "receiving": [
            "03f6d41f6d51d31df3fe13f1d3521fd35fe5131ff1f11f133fd31fd35d1fd3f639", 
            "026e61fd6df1fd6fd6f16d1fdc6c1d6f1d6f1e61f8d4d6c1d65f6df1df1d3f5e14", 
            "03ef1dsdgsdgsg6f1d6d1c6d51fd651fed1c63d13fd13f1d32f1d3f31db5e8286a", 

```

...

I thought that these should be just addresses, but obviously they are not. It gets even stranger when I import the file into Electrum - it then automatically changes these values to addresses (in the file too). I don't think, that it's something like a private key - it's 66 chars long. Even if - when imported, Electrum still asks me for it.
**What does this all mean and how do I get information about transactions/addresses/amounts?**

**Tags:** wallet, electrum

> **Comments:**
> **username_1**: look in the keystore section for private key data. if you can extract that then you can restore your wallet with it and electrum will recreate the rest.  

---

## 1 answers

### Answer by username_2 on 2018-10-26. Score: 0 | Accepted answer

The fields you are seeing are raw ECDSA public keys.


---

