Are you seeing "Error: LevelDB lock file found" or "manifest file missing" when opening MetaMask? Did a browser crash or OS update result in your MetaMask extension appearing empty? This forensic guide covers how to extract the Vault Data from the raw `.ldb` files when the UI completely fails.
1. Locating the Raw Vault Files
MetaMask stores its data (the encrypted vault containing your seeds) in a LevelDB database within your browser's user profile. You must navigate to the specific directory for your operating system:
- Windows (Chrome) %AppData%\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
- MacOS (Chrome) ~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn
- Brave Browser .../Brave-Browser/User Data/Default/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn
2. Extracting the "Vault" String
Once inside the `nkbih...` folder, you will see several `.ldb` and `.log` files. Your encrypted seed phrase is hidden inside one of these. We use the strings command or a Hex Editor to find it.
# On MacOS/Linux, run this inside the folder:
grep -a "vault" *.ldb
# You are looking for a JSON string starting with:
# {"data":"...","iv":"...","salt":"..."}
WARNING If you find your vault string, never paste it into an online "decryptor" website. Attackers host fake recovery tools to steal the data once you enter your password. Use offline tools like the MetaMask Vault Decryptor (locally hosted) only.
3. What if the .ldb files are corrupted?
If the database is corrupted, the standard strings command might return nothing. At Rollan Forensics, we use LevelDB Page Analysis. We scan the raw sectors of the drive to find LevelDB "data pages" that haven't been overwritten. Even if the manifest is gone, the encrypted ciphertext often remains.
"LevelDB uses a log-structured merge-tree. This means old versions of your vault may still exist in older .ldb files that the browser hasn't compacted yet. This is often the key to recovering 'deleted' wallets."
4. When to Call for Forensic Support
DIY recovery is possible if the files are intact. However, professional status is required if:
- "Device Not Recognized": Your SSD has failed or is in "Read-Only" mode.
- Vault is Partially Overwritten: You need bit-level carving to find the missing IV or Salt.
- Significant Assets: You cannot risk a mistake that permanently corrupts the database.
Attempting DIY recovery on a failing drive can permanently destroy the data platters.
We partner with DataClinic UK & Leading US Firms.