My research delves into Exodus, a thin-client, closed-source cryptocurrency wallet designed with a strong emphasis on privacy. Through a comprehensive longitudinal study of disk, memory, and network artifacts on a Windows system during and after cryptocurrency transactions and application uninstall, I successfully uncovered critical artifacts such as private keys and passphrases. Additionally, I validated Exodus' encryption protocols and confirmed its legitimate network activity during its use.
This experience allowed me to perform essential forensic assessments with precision and integrity, showcasing mastery in hardware disk recovery, RAM and memory analysis, and a deep understanding of complex network operations—skills capable of withstanding the toughest audits
Tools
- Exodus Wallet
- Wireshared 3.4.2 (network packet capture & Anallysis)
- Npcap 1.10 (Packet capture library for Windows)
- Memoryze 3.0 (RAM live memory acquisition and analysis)
- Redline 2.0.0 (GUI for memory forensics)
- Disk Pulse Pro (Real-time disk monitoring)
- Agent Ransack (Advanced desktop search tool)
- FTK Imager 3.2.0 (Forensic imaging tool for disk and RAM)
- Bulk Extractor 1.5.2 (Command-line data extraction tool)