Recovering deleted wallet/files from HDD

[HCP]

Anyway, I'm going to move all my funds into new wallets, just in case, it doesn't cost me much in either time or money

*ETH Gas fees have entered the chat*


Based on the fact that you mentioned Metamask... you might get hammered with some serious fees depending on how many different tokens you need to move around

[1715229198]

1715229198

[1715229198]

1715229198

[1715229198]

1715229198

[fillippone]

Just got my laptop back, which has an integrated keylogger as well

Well, this is an interesting plot twist: has your laptop an integrated key logger? How comes that?

Also: move your coins now. You are already late.

[LoyceV]

I see that he hasn't snooped into Chrome at least, can never be too sure about the rest of the hard drive.

If I would want to read someone's files without them knowing about it, I would create an image of the entire drive. This can easily be done by booting a Linux LIVE OS, or by temporarily plugging the drive into another computer. You wouldn't see any of this on your file system.

[Ultegra134]

Anyway, I'm going to move all my funds into new wallets, just in case, it doesn't cost me much in either time or money

*ETH Gas fees have entered the chat*


Based on the fact that you mentioned Metamask... you might get hammered with some serious fees depending on how many different tokens you need to move around

It's a few hundred of BUSD and a pair of stablecoins staking on Beefy.Finance, which I was planning to withdraw and deposit to another contract anyway. Despite how much it might end up costing, at least, I'll be on the safe side and not have to worry about it anymore.

I see that he hasn't snooped into Chrome at least, can never be too sure about the rest of the hard drive.

If I would want to read someone's files without them knowing about it, I would create an image of the entire drive. This can easily be done by booting a Linux LIVE OS, or by temporarily plugging the drive into another computer. You wouldn't see any of this on your file system.

Definitely, it's not a hard thing to do, if he wanted to compromise my files, then it's up to him, since I stupidly gave a stranger full permission on my computer, what was I thinking.

Just got my laptop back, which has an integrated keylogger as well

Well, this is an interesting plot twist: has your laptop an integrated key logger? How comes that?

Also: move your coins now. You are already late.

Just some kind of extension on Chrome, records every tap of the keyboard, nothing special. It just looks like Chrome has been left untouched. The whole HDD might be left untouched but it's definitely better to stand on the safe side.

[LoyceV]

Just some kind of extension on Chrome, records every tap of the keyboard, nothing special.

This sounds like a security risk, is there a reason you've installed some sort of spyware in your browser?

[Ultegra134]

Well, this is an interesting plot twist: has your laptop an integrated key logger? How comes that?

Also: move your coins now. You are already late.

Just some kind of extension on Chrome, records every tap of the keyboard, nothing special. It just looks like Chrome has been left untouched. The whole HDD might be left untouched but it's definitely better to stand on the safe side.

Excuse me for being a bit paranoid, but are you sure the extension doesn't steal your personal data or everything you type on Chrome? At very least, check what kind of permission the extension ask.

I've checked the permissions before, it only logs locally user inputs, they are not sent anywhere, it doesn't have access to anything else.

Just some kind of extension on Chrome, records every tap of the keyboard, nothing special.

This sounds like a security risk, is there a reason you've installed some sort of spyware in your browser?

Thinking back to it, I shouldn't have installed such a thing, its sole purpose was to catch someone snooping through my laptop, (I mean in the same household) and have solid proof they did it, since history could be deleted and be done with it.

From what it claims, it doesn't send any data, and it's stored locally, however, I don't see a reason to keep it anymore, nevertheless, it does look like a safety concern.

[LoyceV]

its sole purpose was to catch someone snooping through my laptop, (I mean in the same household)

That's why I always lock my screen (set a shortcut if you don't have it yet) when I walk away. No matter how short, I don't get up before locking it.

[figliar0]

its sole purpose was to catch someone snooping through my laptop, (I mean in the same household)

That's why I always lock my screen (set a shortcut if you don't have it yet) when I walk away. No matter how short, I don't get up before locking it.

I do the same - habit from past job where I had a little bit strange collegue. Just for the record: this is not very secure solution, some lock screen in linux environment can by bypassed, don't know about other OSes. It is good to prevent children from play with your workstation, but if someone has enough time, it won't help.

[Stalker22]

Anyway, I'm going to move all my funds into new wallets, just in case, it doesn't cost me much in either time or money

I would strongly recommend it. Although you got your laptop back, your wallet can still be compromised. You cannot be absolutely sure that someone did not copy your wallet (or your entire hard drive) or exported your private keys. I wouldn't use that wallet for serious money again if I were you.

[Lotus]

Yes, someone might have cloned your content and is still working on recovering & scanning the relevant files. Safest option is not to use file-based wallets anyway if you can afford it.

[HCP]

Safest option is not to use file-based wallets anyway if you can afford it.

What would you recommend if not "file-based wallets"? Are you talking about hardware wallets?

[Lotus]

Of course. In a sense, a hardware wallet still stores the content locally in its own stores, but you get the point.

[QuickAccount]

~snip

From what it claims, it doesn't send any data, and it's stored locally, however, I don't see a reason to keep it anymore, nevertheless, it does look like a safety concern.

What is the name of the extension? I would like to dump the source code of of it to see if it sends data anywhere.

[Ultegra134]

~snip

From what it claims, it doesn't send any data, and it's stored locally, however, I don't see a reason to keep it anymore, nevertheless, it does look like a safety concern.

What is the name of the extension? I would like to dump the source code of of it to see if it sends data anywhere.

The name of the extension is Fea Keylogger, it mentions that it stores all data locally, or at least I hope it does. It'd be interesting to check if it's actually true or not, make sure to report back when you're done testing.

Link: https://chrome.google.com/webstore/detail/fea-keylogger/fgkghpghjcbfcflhoklkcincndlpobja?hl=en

[QuickAccount]

~snip

From what it claims, it doesn't send any data, and it's stored locally, however, I don't see a reason to keep it anymore, nevertheless, it does look like a safety concern.

What is the name of the extension? I would like to dump the source code of of it to see if it sends data anywhere.

The name of the extension is Fea Keylogger, it mentions that it stores all data locally, or at least I hope it does. It'd be interesting to check if it's actually true or not, make sure to report back when you're done testing.

Link: https://chrome.google.com/webstore/detail/fea-keylogger/fgkghpghjcbfcflhoklkcincndlpobja?hl=en

I installed the extension on a Virtual Machine, found a few issues right off the bat.

The extension communicates with the internet, something that "Only saves data locally" shouldn't connect to the internet. They're is also another issue with the extension, it logs specifically logins, not just web pages visited and such. After further analysis, the data that it saves isn't even hashed, meaning that all of your logins are compromised if someone gets the data from your local storage of the extension.

My advice would be to uninstall the extension, reinstall chrome, then change all of your passwords.

[Ultegra134]

~snip

From what it claims, it doesn't send any data, and it's stored locally, however, I don't see a reason to keep it anymore, nevertheless, it does look like a safety concern.

What is the name of the extension? I would like to dump the source code of of it to see if it sends data anywhere.

The name of the extension is Fea Keylogger, it mentions that it stores all data locally, or at least I hope it does. It'd be interesting to check if it's actually true or not, make sure to report back when you're done testing.

Link: https://chrome.google.com/webstore/detail/fea-keylogger/fgkghpghjcbfcflhoklkcincndlpobja?hl=en

I installed the extension on a Virtual Machine, found a few issues right off the bat.

The extension communicates with the internet, something that "Only saves data locally" shouldn't connect to the internet. They're is also another issue with the extension, it logs specifically logins, not just web pages visited and such. After further analysis, the data that it saves isn't even hashed, meaning that all of your logins are compromised if someone gets the data from your local storage of the extension.

My advice would be to uninstall the extension, reinstall chrome, then change all of your passwords.

Interesting, I remember looking it up to find anything suspicious but couldn't, anyway, good detective work. It logs any kind of text input, it often saved my posts here. Anyway, I've now uninstalled it, since I do not need it anymore and due to the suspicion of it being a security hazard.

On the other hand, do you know any kind of similar software that is safe to use?

[QuickAccount]

~snip

From what it claims, it doesn't send any data, and it's stored locally, however, I don't see a reason to keep it anymore, nevertheless, it does look like a safety concern.

What is the name of the extension? I would like to dump the source code of of it to see if it sends data anywhere.

The name of the extension is Fea Keylogger, it mentions that it stores all data locally, or at least I hope it does. It'd be interesting to check if it's actually true or not, make sure to report back when you're done testing.

Link: https://chrome.google.com/webstore/detail/fea-keylogger/fgkghpghjcbfcflhoklkcincndlpobja?hl=en

I installed the extension on a Virtual Machine, found a few issues right off the bat.

The extension communicates with the internet, something that "Only saves data locally" shouldn't connect to the internet. They're is also another issue with the extension, it logs specifically logins, not just web pages visited and such. After further analysis, the data that it saves isn't even hashed, meaning that all of your logins are compromised if someone gets the data from your local storage of the extension.

My advice would be to uninstall the extension, reinstall chrome, then change all of your passwords.

Interesting, I remember looking it up to find anything suspicious but couldn't, anyway, good detective work. It logs any kind of text input, it often saved my posts here. Anyway, I've now uninstalled it, since I do not need it anymore and due to the suspicion of it being a security hazard.

On the other hand, do you know any kind of similar software that is safe to use?

I couldn't really recommend any monitoring software for your own machine, but I think you'll be safe enough by pressing WIN + L when you get up to lock your screen, or encrypt your computer files when you leave for a long period of time.

[ABCbits]

On the other hand, do you know any kind of similar software that is safe to use?

There are open source version of such software, but i wouldn't recommend it unless you bother audit/test it properly. Besides there's saying "Prevention is better than cure". If you haven't done any action, you could start from enabling 2FA on your online account and using stronger password.

or encrypt your computer files when you leave for a long period of time.

It's not practical if you also want to secure your cryptocurrency wallet or browser data, where the file could be scattered on different folder. You could use full disk encryption (such as BitLocker for Windows and LUKS for Linux), but usually you need to enter password/PIN every time you turn on your laptop and recovery process is harder (if the disk is corrupted).

[danuker]

I see that he hasn't snooped into Chrome at least

It would be trivial to mount a drive without touching the files on it (such as Chrome history). Any Linux live USB offers read-only mount support.

Yeah, I'll move everything to new wallets just in case, you can never be safe enough. On top of that, if we suppose that he has snooped through my files, he could potentially try to compromise the wallets at a much later date. That way, no accusation can actually be directed to him.

Absolutely. If I were you, I would definitely pay the transaction fee to move the coins to a new wallet.

[DaveF]

I see that he hasn't snooped into Chrome at least, can never be too sure about the rest of the hard drive.

If I would want to read someone's files without them knowing about it, I would create an image of the entire drive. This can easily be done by booting a Linux LIVE OS, or by temporarily plugging the drive into another computer. You wouldn't see any of this on your file system.

Or buy a hardware cloner, clone the drives and read them later.
Put client disk in slot 1 blank disk in slot 2 & push a button. Drink beer. Then put disk back in client PC.
PCs / phones / tablets. We live our life on them now, and even the paranoid people can't remember everything that they may have accidentally stored on one.

-Dave