How to check an old laptop or hard drive for cryptocurrency

From 2009 through roughly 2015, the most common way to hold Bitcoin was on your personal computer. Bitcoin Core — the original Bitcoin software — installed on Windows, Mac, or Linux and created a file called wallet.dat in a specific folder. That file contained the private keys to your Bitcoin. If you didn't move those coins elsewhere and didn't wipe the drive, the wallet.dat file is likely still there.

This is why old laptops from this era can be worth far more than their resale value as hardware. Here's how to approach checking one — safely.

Which laptops are most likely to contain Bitcoin?

Not every old laptop is worth investigating. The probability varies significantly based on who owned it and when. The highest-probability machines share these characteristics:

• Era: 2009–2015. Bitcoin Core didn't encrypt wallets by default until version 0.4.0 in September 2011, meaning wallets created before that date store private keys in plaintext — no password needed.
• Operating system: Linux (especially Ubuntu), Windows XP, Windows 7. Early Bitcoin adoption was heavily concentrated among Linux users and open-source communities.
• Owner profile: Software developer, network engineer, computer science student, technology enthusiast, or anyone with an interest in cryptography or libertarian/privacy communities during that era.
• Drive type: Spinning hard drive (HDD), not SSD. SSDs with TRIM functionality actively erase deleted data, making recovery much harder. Old HDDs preserve data in unallocated space for years.
• Usage history: A machine that was used actively through 2012 and then largely set aside is more promising than one that received years of heavy use after that period.

What you're looking for

Bitcoin Core wallet files

The file is called wallet.dat and lives in a specific location depending on the operating system:

• Windows XP: C:/Documents and Settings/[username]/Application Data/Bitcoin/
• Windows 7/8/10: C:/Users/[username]/AppData/Roaming/Bitcoin/
• macOS: ~/Library/Application Support/Bitcoin/
• Linux: ~/.bitcoin/

Other wallet software

Bitcoin Core wasn't the only wallet. Electrum (stores a file called "default_wallet" in a .electrum folder), MultiBit (files ending in .wallet or .key), and Armory (files ending in .wallet in an Armory folder) were all popular during the early period.

Seed phrases and private keys in text files

Many early users wrote down private keys or seed phrases and saved them as text files — sometimes named obviously ("bitcoin keys.txt"), sometimes not. A full-drive scan for crypto-related strings is worth running alongside the wallet file search.

The right way to check — and the wrong way

The wrong way

Booting the laptop normally and browsing to the Bitcoin folder. The problem: the moment Windows or macOS boots, the operating system starts writing data to the hard drive — swap files, temporary files, log files. If the wallet.dat was in unallocated space (deleted but not overwritten), normal use can overwrite it permanently. This is how families accidentally destroy recoverable wallets.

The right way

A forensic investigation begins with creating a bit-for-bit image of the drive before anything else happens. This image is an exact copy of every sector of the drive — including unallocated space where deleted files live. All analysis happens on the image, never on the original drive. The original is never modified.

This requires a forensic write blocker — a hardware device that physically prevents any writes to the drive while it's being read. Without write blocking, simply connecting a drive to a computer can cause the OS to modify it.

What if you want to check yourself without professional help?

If the machine is functional and you want to do a basic check before deciding whether to pursue professional investigation, here's the safest approach:

1. Do not boot from the original drive. If possible, remove the hard drive and connect it externally to another machine using a USB-to-SATA adapter.
2. On Windows, hold Shift while connecting the drive — this prevents Windows from automatically indexing it.
3. Navigate to the Bitcoin folder paths listed above and check whether wallet.dat exists.
4. If you find a wallet.dat, do not open it, move it, or copy it to a cloud-connected location. Note that it exists and contact a professional.

What if the drive has been reformatted?

A reformatted drive is not necessarily a lost cause, especially if the reformat was a quick format rather than a full wipe. Quick format operations on Windows simply mark the space as available — they don't actually overwrite the data. The wallet.dat file may still be recoverable through file carving techniques that search the raw drive sectors for wallet file signatures.

The older the drive and the less it was used after reformatting, the better the chances of recovery. SSDs are a different story — with TRIM enabled, a quick format on an SSD may genuinely erase the data at the hardware level.

The bottom line on probability

Most old laptops don't contain Bitcoin wallets. The probability is low in absolute terms. But the potential value — even a fraction of a Bitcoin at current prices — makes examination worthwhile for machines that fit the profile. A professional investigation on a likely machine costs far less than leaving a significant asset unexamined.