# Autopsy Crypto Wallets + Test File

**URL:** <https://sleuthkit.discourse.group/t/autopsy-crypto-wallets-test-file/2693>\
**Category:** Autopsy Help\
**Created:** [June 25, 2021, 11:33am UTC](https://sleuthkit.discourse.group/t/autopsy-crypto-wallets-test-file/2693 "2021-06-25T11:33:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Echzer](https://avatars.discourse-cdn.com/v4/letter/e/c37758/32.png) [@Echzer](https://sleuthkit.discourse.group/u/Echzer)\
**Post date:** [June 25, 2021, 11:33am UTC](https://sleuthkit.discourse.group/t/autopsy-crypto-wallets-test-file/2693/1 "2021-06-25T11:33:13Z")

</div>

Hey there

I am currently working on a paper to compare various forensic tools.  
I saw that it has a crypto wallet integration ([Add Rules for Crypto Currency Wallets · Issue #5950 · sleuthkit/autopsy · GitHub](https://github.com/sleuthkit/autopsy/issues/5950)).

Is there a test file or a test VM where I can use this? Has anyone had any experience?  
How deep does the analysis of the wallets go? Is it possible to see outgoing transactions etc.?

In the end, my analysis will be used for educational purposes at our school, which has Autopsy in the curriculum.

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [June 25, 2021, 12:58pm UTC](https://sleuthkit.discourse.group/t/autopsy-crypto-wallets-test-file/2693/2 "2021-06-25T12:58:17Z")

</div>

All this feature does is identify if wallets have been installed on the system so an examiner is aware they are there. It is up to the examiner to take it from there in doing analysis on the wallet(s). There is no public test image I am aware of with the wallets installed on them.