Default locations in the reviewed source
InstallationManager chooses the following application-data locations. These describe the reviewed historical code, not every possible redirected user profile, portable installation or recovered disk image.
Windows: %APPDATA%\MultiBitHD
macOS: ~/Library/Application Support/MultiBitHD
Linux: ~/.MultiBitHDPreserve the directory, not one promising file
Keep the full MultiBitHD directory and the wallet subdirectories beginning with mbhd-. Preserve the original filenames and folder relationships. A copy containing only mbhd.wallet.aes may omit useful wallet summaries, rolling backups or encrypted ZIP backups. Copies from another date can also be useful; do not discard an older folder just because a newer one exists.
Build a non-secret inventory
For each copy, record the source device, original location, copy date, byte size and a SHA-256 fingerprint. Keep that inventory private when it includes personal paths. A fingerprint helps identify duplicate or changed copies; it does not tell you whether the wallet can be decrypted. Save your notes outside the original directory so the record does not modify the evidence it describes.
Look beyond the active user profile
An old disk, migrated computer account, external drive or operating-system backup may contain another copy. Search only storage that you own or are authorized to inspect. If the device is failing, repeated browsing or software installation can make preservation harder. Stop and plan the acquisition rather than using the only surviving device as an experimental recovery workstation.
Keep misleading clues in perspective
A timestamp can change during a copy or restore. A renamed file may still hold the same bytes. A zero-byte file is not repaired by changing its extension. A directory name beginning with mbhd- does not prove that its contents are complete. Compare several signals—origin, structure, size and format—before deciding which copy is the best candidate.
Next step
Use the backup-format guide to separate rolling wallet snapshots from encrypted ZIP archives. Preserve both groups. The source browser includes InstallationManager for location selection and WalletId for the relationship between the wallet identifier and its directory name.