Product / Digital asset discovery

Recovery CAT: the discovery engine for digital assets in data.

Find the private keys, seed phrases and wallets inside the data you already hold, confirm what they control, and put every find on the record.

Request a pilot → See the platform
01 // The problem
CATLABS · 01

The asset is often already in your data.

/01

Tools assume an address

Blockchain analytics start with a wallet address. In most cases you have a device, a drive and a warrant return instead.

/02

Manual review misses keys

Seed phrases hide in photos, screenshots, notes and documents across terabytes of evidence.

/03

Time matters

Anyone else holding a copy of the key can move the funds while the evidence waits in a review queue.

In 2022, U.S. authorities recovered about $3.6 billion in bitcoin using private keys found in a file in a suspect's cloud storage.

02 // What it finds
CATLABS · 02

The material that controls the asset.

  • Private keysand other cryptographic key material, including key shares
  • Seed phrasesrecovery and mnemonic phrases, including in photos and handwriting
  • Wallet filessoftware, browser and hardware wallet artifacts
  • Addresses & QR codesstarting points for tracing, freezing and legal process
  • Exchange recordsapps, emails and KYC documents that point to custodial accounts
  • Credentialsbrowser stores and keychains that unlock wallets
03 // Supported sources
CATLABS · 03

Reads the evidence your tools produce.

SourceFormats and examples
Computers and drivesE01, AFF4 and FileVault-locked APFS images; hard drives and removable media
Mobile devicesCellebrite UFDR extractions; messages, images, apps and notes
Forensic casesMagnet AXIOM portable cases; output from FTK and similar tools
Cloud and emailCloud and email warrant returns and productions
Documents and mediaPDFs, spreadsheets, archives, screenshots, photos and handwriting
04 // How it works
CATLABS · 04

Find. Validate. Value. Record.

01Find

Scan the image or collection for key material and wallet artifacts.

02Validate

Check checksums, derive addresses across chains and paths, and reconstruct missing seed words.

03Value

Check live balances where supported, so teams act on what matters first.

04Unlock

Decrypt supported browser stores, keychains and wallets under your process.

05Record

Log every view, export and derivation on the private-key-material ledger and export a portable case.

05 // Built for defensible work
CATLABS · 05

Discovery you can defend.

Audit trail

Every key on the ledger

Who saw, exported or derived each key, and when.

Analysis

Target package

Ranks financial-crime associates from chats and email, links wallets and exchanges, and drafts subpoena templates.

Deployment

Air-gapped ready

On premises, fully air-gapped, or in AWS GovCloud and Azure Government.

06 // Private key audit trail
CATLABS · 06

Every view, derivation and balance check on the record.

Recovery CAT logs who opened each dataset, who viewed each private key or seed, and every derivation and balance check, by analyst, case and evidence item. Supervisors and auditors can filter the full history in seconds.

Recent PKM Activity

1 to 50NewerOlder
Search analyst, case, dataset, artifactAny action ▾Any case ▾Pick a case ▾mm/dd/yyyymm/dd/yyyyAll analysts
WhenAnalystActionCaseDatasetArtifactValue
›Oct 14, 3:13 PMSA M. REYES––1 artifact–
›Oct 14, 2:58 PMEXAMINER D. OKAFOROpened dataset26-0412 DARKNET VENDORPixel7_UFDR_Item004212 artifacts–
›Oct 14, 2:51 PMEXAMINER D. OKAFORViewed PKM26-0412 DARKNET VENDORPixel7_UFDR_Item004seed #0118–
›Oct 14, 2:50 PMEXAMINER D. OKAFORDerivation26-0412 DARKNET VENDORPixel7_UFDR_Item004seed #0118–
›Oct 14, 2:49 PMEXAMINER D. OKAFORBalance check26-0412 DARKNET VENDORPixel7_UFDR_Item004seed #0118$41,280
›Oct 13, 4:22 PMDET. L. NGUYENViewed PKM26-0388 RANSOMWAREMacBookPro_E01_Item002private key #0041–
›Oct 13, 4:20 PMDET. L. NGUYENOpened dataset26-0388 RANSOMWAREGoogleDrive_WarrantReturn_09151,406 artifacts–
›Oct 13, 3:02 PMSA M. REYESBalance check26-0351 ROMANCE FRAUDiCloud_Return_Item011seed #0007$9,615
›Oct 13, 2:59 PMSA M. REYESViewed PKM26-0351 ROMANCE FRAUDiCloud_Return_Item011seed #0007–
›Oct 13, 2:41 PMSA M. REYESOpened dataset26-0351 ROMANCE FRAUDiCloud_Return_Item01138 artifacts–

Illustrative example. Analyst names, cases, datasets and values are fictional.

07 // Next release
CATLABS · 07

From discovery to custody.

Seizure & Monitoring

Records the date of seizure and the balance at that moment, tracks activity since, and gates seizure actions on legal authority being in force.

Hand-off to Security CAT

Validated keys move into threshold-encrypted custody instead of a case folder. Security CAT →

08 // Asset monitoring dashboard
CATLABS · 08

Every asset tied to a case, watched and accounted for.

Seizure & Monitoring sorts every private key by where its assets stand: awaiting seizure, seized and in government custody, or watched without authority to move. Balances update from the chain, custody wallets are reconciled against approved transactions, and any unauthorized movement is flagged.

Recovery CAT
DashboardAsset DiscoverySeizure & Monitoring NEWCases
● Live○ Air-gapped

Seizure & Monitoring

Search cases…Enter PKM manually+ New case

Awaiting seizure

$5,079,261

5 PKM across 4 cases · Still in the target wallet. Monitored; seizure authority pending or confirmed but not yet executed.

Seized · in custody

$12,904,338

1 PKM across 1 case · Moved to a government-controlled wallet. Monitored and reconciled against approved transactions.

! 1 unauthorized movement, unreconciled

Monitor only, post-seizure

$1,299

1 PKM across 1 case · Target key already swept. Watched for new deposits or movement on the original addresses.

Monitor only, no authority

$144,200

2 PKM across 2 cases · No seizure has occurred and none is anticipated. Watched, never moved.

$18,129,098 across 9 PKM, 9 datasets and 6 cases. Select a tile to filter.

›

CASE-26-184 Vale, darknet marketplace proceeds Field Office 3 · SUBJ-0417 · created 2026-09-02 · 2 datasets · 2 PKM

Seed Phrase: 3Private Key: 1Wallet: 6Address: 214
2 awaiting seizure

Under management

$2,843,221

Expand for PKM

›

CASE-26-045 Okonjo, sanctions evasion and mixer activity Financial Crimes Unit · SUBJ-0392 · created 2026-08-28 · 1 dataset · 1 PKM

Seed Phrase: 1Wallet: 2Address: 78
1 awaiting seizure

Under management

$1,204,880

Expand for PKM

›

CASE-25-771 Petrov, forfeiture and post-seizure custody Asset Forfeiture Unit · SUBJ-0203 · created 2025-11-14 · 2 datasets · 2 PKM

Seed Phrase: 2Wallet: 4Address: 1,102Credential: 7
1 in custody1 post-seizure watch1 unauthorized movement

Under management

$12,905,637

Expand for PKM

Illustrative example from the Seizure & Monitoring module. Cases, subjects and values are fictional.

09 // FAQ
CATLABS · 09

Questions institutions ask first.

Is Recovery CAT a forensic extraction tool?

No. It works on the output of extraction tools you already run and adds the digital asset pass.

Is it the same as Chainalysis, TRM or Elliptic?

No. Those tools trace activity once you have an address. Recovery CAT finds the keys and wallets inside your data first. Most agencies use both.

Who can buy it?

Government agencies, forensic labs and qualified institutions working on data they are authorized to review. It is not a consumer wallet-recovery service.

How do we evaluate it?

A scoped pilot on real data in your own environment, with training for the examiners who will use it.

Recovery CAT pilot

Find out what your evidence already holds.

A pilot runs on your data, in your environment, with your examiners.

Request a pilot → Training & certification