Open, and taking cases in · 9am–5:30pm, weekdays In a hurry? Call 0800 6890668
CDR Cardiff Data Recovery 0800 6890668 Book it in
CDR / Work we specialise in / Crypto wallet recovery

Specialist · crypto wallet recovery

Cardiff crypto wallet recovery. The wallet is a file we can recover; a spent coin is gone.

The coins sit on the blockchain. The keys that spend them sit in a file on your computer — wallet.dat from Bitcoin Core, a .json from Electrum, the app data behind Exodus or Atomic, a browser vault holding MetaMask. When that disk fails, gets formatted, or the file is deleted and the machine passed on, getting it back is a storage job like any other, and it runs the same way here: images taken read-only, carving done on the copies, nothing written to what you sent. What no one can do is reach into the chain itself. Drives reach us by post from across Cardiff and South Wales; the limits are set out plainly further down.

No files back, no fee on most jobs One fixed price, after a free diagnosis It comes to us by post from Barry, Pontypridd or Newport

Describe the symptoms to an engineer
0800 6890668

What each wallet symptom is telling you.

Not listed here? Try the triage →
What shows upWhat has gone wrongDo this now
The wallet file has gone from the folderDeleted — but until something writes over it, the data may still be thereStop using that machine
Bitcoin Core starts up with an empty walletIt could not read the old wallet.dat, so it made a new oneClose it before it starts a rescan
That drive was formatted by mistakeA format lays down a fresh index, not usually fresh dataWrite nothing else to that disk now
The old PC was wiped and passed onHow much survives turns on the wipe and on what came afterGet the machine back first
MetaMask asks for a seed phraseThe extension vault sits in the browser profile on that diskLeave the browser profile alone
The laptop holding the wallet is deadIt may be the disk, or only the machine built around itPower it off; send the drive
Posting it to us: post it tracked and fully insured to the intake lab, and the journey back is on us; ring first if you would like an engineer to check how it is packed before you seal the box. Every stage is set out on the posting guide.

Where the keys live, and what we can reach.

What a wallet file isNot a purse. A file holding the private keys that let you spend what the chain already records as yours. Lose the file and the coins stay on the chain, out of reach. Recover the file and the keys come back with it.
Wallets we see most oftenBitcoin Core wallet.dat, Electrum .json files, Armory, Daedalus, the app data behind Exodus and Atomic, and the browser-extension vaults MetaMask and Trust Wallet keep inside a Chrome or Firefox profile.
Deleted, formatted, wipedEach leaves a different amount behind. A delete normally leaves the file whole until the space is claimed again. A quick format swaps the index and little more. A full overwrite, or TRIM on an SSD, leaves nothing at all. Fragments still count: part of a wallet file is sometimes enough to lift individual keys out of it.
Where our work has to stopWe cannot reverse a transaction, retrieve coins sent to a scammer, or trace and hand back stolen funds — nobody can. A wallet belonging to someone else stays shut, and proof of ownership is asked for every time. Nor can a seed phrase be invented: recovery reaches only what the media still holds.

From the parcel to your files coming back.

Cases we have logged →
01

A case number, and a diagnosis at no cost Free

The diagnosis costs you nothing. Every item that arrives is logged under a case number of its own, and an engineer works out what has actually failed — then tells you plainly which files can come back and which cannot. The price follows that: one fixed figure, in writing, and no work begins until you have read it and said go ahead.

Diagnosis at no chargeOne fixed figure in writingNothing owed yet
02

Copies first, originals untouched

The disk, stick or card is cloned to an image, read-only, and anything unstable is taken in slow passes with the sectors that will not answer stepped over. Every later step runs on that copy.

Your media is only ever readNothing written back to it
03

Locate the wallet data

Wallet files have shapes worth searching for: the Berkeley DB header inside a wallet.dat, the key names in an Electrum .json, the folders Exodus and Atomic keep their vaults in. Deleted ones are carved out of free space, fragments included, and dated against the file system.

Wallet files locatedDeleted copies carved back out
04

Open the wallet, then prove it loads

A file that shows up in a listing proves nothing on its own. Each candidate is opened in the software it belongs to, on a bench machine with no network, so the keys can be confirmed readable. Password work, where you own the wallet, begins at this point.

Opened in its own softwareKeys read, not just listed
05

You approve it, then it goes back

Nothing is billed while you are still deciding. A complete listing of what came off the drive reaches you first, and the invoice only follows your yes. Files travel back on media bought new for the job, return postage ours, and we do not close it here until every one of them opens on the machine you will use.

The file list is yours to approveBack on media bought newThe postage back is on us

What we usually find first

  • A deleted wallet is not gone the moment it vanishes — the entry leaves the index while the blocks sit where they were, waiting for something else to claim them. That gap is what we work in, and it narrows every time the computer is used.
  • An SSD is a harder case than a spinning disk — TRIM tells the drive to clear deleted blocks in the background, often within minutes of a delete or a format, and once that has run there is nothing left to carve. On a mechanical drive the window stays open far longer.
  • A password is not a seed phrase — the password unlocks one wallet file on your disk, and where you own that wallet we can put real work into it. A seed phrase rebuilds the whole wallet on any device anywhere, which is why nobody honest will ever ask you for yours. We do not, and we never will.
  • A confirmed transaction is final — once coins have moved on the chain, no engineer, no tool and no fee brings them back. If somebody has told you otherwise and wants paying up front, that is a second fraud, not a fix.

What we can and cannot promise: our work is on storage. Wallet files off failed, formatted or deleted media; carved copies where the space has not yet been reused; a password attack on a wallet you can show is yours. We cannot reverse a transaction, chase a scammer, or trace and return coins that have already moved. We cannot open a wallet belonging to somebody else, and we ask for proof of ownership before we try. Nor can a seed phrase be conjured from nothing — if it was never on the media, it is not there to find. The free diagnosis tells you which of those you are in.

Straight out of the casebook.

CF · CDF-2026-0846LOGGED ✓

The tower cleared out before anyone remembered the wallet

A 2014 desktop came down from a loft in Cardiff and went to a friend for a clean-up, who reinstalled Windows over the top of it. Only afterwards did the owner remember the Bitcoin Core wallet that had been on there. Both drives were imaged. A wallet.dat and two older copies came out of free space on the mechanical disk, and each was opened on a bench machine with the network off. Ownership was evidenced before anything left the lab.

Both drives imaged in full3 days after arrival

Before you send it off.

Start with these

  • Turn the machine off and leave it
  • Note which drive held the wallet, and when
  • Send the bare drive, not the laptop or the tower
  • Tell us the wallet software and version, and what has been done since

What to avoid

  • Carrying on using that computer as normal
  • Running recovery software onto the same disk
  • Reinstalling Windows or the wallet app
  • Giving your seed phrase to anybody

What we get asked, week in, week out.

Can you recover coins that a scammer took from me?

No, and anyone who tells you otherwise is selling you a second loss. A confirmed transaction on a public chain cannot be undone by us, by an exchange, or by any software. Tracing where coins went is police work, sometimes with a blockchain analytics firm alongside — it is not recovery, and it returns nothing on its own. Our work is different: wallet files taken off storage that has failed, been formatted, or been cleared. Report the fraud to the police, and pay nobody an up-front fee to get your money back.

The wallet file was deleted. Is it still on the disk?

Often, for a while. A delete strikes the file's name out of the index and abandons its contents in place, so a wallet.dat can sit whole in space the system now counts as free. It stays readable until something writes over it — an update, a browser cache, a new install. So the sensible move is to switch the machine off rather than hunt through it. On a mechanical disk the window can run for months. On an SSD, TRIM usually clears those blocks within minutes, and then there is nothing to carve.

I have the wallet file but not the password. Can you help?

Sometimes, and only where you can show the wallet is yours. The file is encrypted with a password you chose, and the attack runs on a copy of it, never on your disk. What decides the outcome is what you can still remember: the words and dates you tended to build passwords from, the length, the substitutions, the keyboard you typed it on. Given that, a targeted attack on a copy has a real chance. Given nothing at all, a long password is beyond any hardware in existence, and we will say so before you spend. A seed phrase is a different matter again: unless you saved it to the media, it was never on there to find. A photograph of one left on a card or a backup is an ordinary recovery job — handsets and tablets we do not take in.

Do I have to prove the wallet is mine before you will work on it?

Yes, and we ask early. It might be the purchase record for the machine, the account the wallet software was installed under, older backups in your name, correspondence, or a grant of probate where the owner has died. Without something of that kind the job stops there. It is not a formality: the request that arrives from an owner locked out of their own wallet reads exactly like the one from somebody holding another person's drive.

Pages people often read next.

Servers that stop → Mail and databases → Arrays & servers → Devices we take in →

An unplugged drive keeps whatever it still holds.

A failing drive has only so many starts left in it. Spend none of them. Keep the power off, and the free diagnosis will tell you what is still readable.

0800 6890668

Get it checked Where to post it