## 1 Introduction
This is particularly critical given the increasing number of these services and apps today for many platforms, including the leading mobile operating systems (i.e., iOS and Android). Furthermore, a lack of understanding of these technologies and their features could have contributed to the potential lack of research on them. Furthermore, any information that leads investigators to data that identify the person operating the wallet could be considered personally identifiable information, which is a significant issue that affects the outcome of many investigations. The need to expand the existing body of knowledge in the area of mobile forensics when it comes to Web3 cryptocurrency wallets is emphasized extensively throughout our work. At the time of this research, no research was available that included the wallets investigated. Therefore, to help forensic investigators and contribute to the body of knowledge, the purpose of this research is to guide investigators to unlock the full potential of cryptocurrency wallets, understand what can be recovered, and look at areas where there are knowledge gaps. Therefore, in this paper, we use a wide variety of techniques that have all played roles in the development of mobile application forensics as it exists today. In addition, to ensure the reproducibility of the digital evidence that was collected, we conducted, validated, and verified the data utilizing two well-known tools. In this study, the use of Magnet Axiom [18] is an example of an industry standard commercial tool that many practitioners use, compared to Autopsy [19], which is a well-known open-source forensic tool. The contributions of this research are as follows:  
* Digitally analyzed and forensically examined two mobile wallets, Trust Wallet [13] and Metamask [11], which are widely used for Web3 cryptocurrencies on Android and iOS devices. Figure 2: Blockchain.com chart of the number of unique wallets created over the years [14]. * Investigated the possibility that those two wallets kept unencrypted data that might have posed a security risk to the user's privacy. * Highlighted Personal Identifiable Information (PII) that can be used as evidence. * Recovered and reconstructed wallets and transactions, as well as NFTs that are owned by the wallet owner. * Reviewed the digital evidence that has been collected and discussed the implications of the forensic tools that were used. * Developed an artifact extension for the iOS Logs, Events, And Plists Parser (iLEAPP) [20] tool to automatically recover information about wallet addresses and transactions as a proof of concept. The remainder of this paper is structured as follows. Section 2 discusses the literature review and other related work that has been conducted. Section 3 explains our research methodology and our experiment design. Detailed findings can be found in Section 4, while Section 5 provides an overview of the tool that we created as a proof of concept and as an outcome of this research. A more in-depth assessment of the analysis and the developed plugin and its significance can be found in Section 6. Finally, Section 7 concludes our research and gives future research directions. Note that Table 1 lists all the abbreviations used in the article.