Topic: 2009 Bitcoin Wallet Help & Possible Find : UPDATE (Read 649 times)

It's in the puzzle thread:

Yes. But you would have know that if you would have mined in 2009.

I'm unwatching this topic.

Please look at this address:

1EHNa6Q4Jz2uvNExL497mE43ikXhwF6kZm

I found this address and private key on my hard drive that is been unplugged since at least 2012. This address has a transaction beginning date of 2011. I was talking with my today who also was an early miner and he told me that I would either have a wallet with 50btc or 0btc due to solo mining back in 2009. Is that correct? Or was there pool mining back in 2009? This transaction beginning in 2011 doesn't help my case because technically i should see a transaction from 2009.

All I did was Google the sending address.

That transaction comes from 17dap8PN1MsU6kJXkxoRTgV1yxwa6j1DzZ, which has it's private key posted in a README on Github.

You're wasting everyone's time.
[/quote]

Thank you for pointing this out about this trans id and private key. Some of my initial held beliefs in conducting scans was that some of the information was going to public or testnet data, also data that leads to nowhere or yields no value. It would be grreat if you could explain this trace of trans ID to private key to me, when I look through my data, I can sort out what is potentially good and bad.

I'm starting to go back and re-scan the drives and isolate the data. There are 3 addresses that I'll post that you should look at, you can tell me if they are BS or not. I think most of the data that I'm scanning is No Good. It is potentially trying to find the needle in the haystack and that is even if the needle is there.  

Please fix your quotes.

I have a hard time believing that. Too many people make up stories for some reason, and your story doesn't add up.

That transaction comes from 17dap8PN1MsU6kJXkxoRTgV1yxwa6j1DzZ, which has it's private key posted in a README on Github.

You're wasting everyone's time.

Feel free to post them.
[/quote]

Can you please explain this transaction to me.

Transaction ID:
c337fabde96f8adbfafaabaed079d87d97f7baa53650586c98df118485acf31a

c337fabde96f8adbfafaabaed079d87d97f7baa53650586c98df118485acf31a


These transactions were completed back in 2015 on addresses and private keys that I own. That are going to a wallet that is accumulating bitcoin.

You're asking the wrong question. You should ask why you have them on your computer, and you're the only one who can answer that.

Anyone can share, leak or lose private keys. It sounds like you've downloaded some of them.

Feel free to post them.

If I'd want to check a large number of addresses, I'd use this:
[/quote]

I checked all the private keys and about 24 addresses come back with transactions that occured over the years. Question I have Loyce is why would there be transactions on these addresses, if I supposedly the only one to have the private keys which don't seem to be the case? Or do I not understand Bitcoin right? Would you like one of the addresses that has transactions?

Maybe it's easier if most of the keys aren't funded. I was thinking of this experience after I imported thousands of private keys:

If I'd want to check a large number of addresses, I'd use this:

Fortunately it's not true for Bitcoin Core. Looking at this thread, some users report they can import million private keys into wallet.dat. Although you need lots of RAM, since Bitcoin Core apparently load entire wallet.dat content into RAM.

And that's why I've noted that if his wallet is from 2009, it's either hundreds or single digit since the earliest versions store the private keys that are generated by the client but do not generate reserves.
And later old versions generate reserves of 100 private keys, next line mentioning thousands is for the "since then" part.
(I've re-included those snipped part on my quoted reply for clarification)

Maybe "reserve" is better term to use to describe both new and old wallets, thanks.

The story started in the summer of 2009 and i remember downloading bitcoin qt and running bitcoin brought my state of the art gaming computer to a stand still for about 3 hours or so. Until I believe I shut off the program. I remember seeing that there was only ever to be 21 million coin and each coin was at .007 cents at the time in value.

Thoroughout the years I stayed in tune with bitcoin, though, i don't remember actively mining after 2009 or 2010. When 2017 came along and it shot up in price and figured I had some lost bitcoin potentially somewhere.
It took my a few more years before I would start the search for it across what would be multiple hard drives because when you're a gamer, I was constantly upgrading hard drives.

After scanning 5 hard drives, these are the results that were outputted. Most of these hard drives haven't been used since 2015. They have just been sitting unplugged and on my computer desk. It really makes me scratch my head when I scan them and the program is finding usable data. It is possible though data migration over the years across these drives. I'm trying know to better understand the backend of Bitcoin and how it truly stores coins/address/private keys.

Is it possible on comprised private keys, I guess, but I never went looking for private keys online. I know how to run Python programs but not C programs. So if you know of Python program that would be great.

How did you go from this:
To this:

You tell me

Bitcion Core doesn't save "other people's private keys". It sounds like you've downloaded some known compromised private keys.

---

---

You shouldn't use Electrum to import 200k private keys. Bitcoin Core will probably have problems too. Just convert them to addresses, and compare with all funded addresses or all addresses ever used. I've used bitcoin-tool years ago, it should be able to convert bulk private keys to addresses. I wouldn't trust it on an online system.

Interesting. I have 223517 private keys that I imported, which, seems excessive. These private keys were in HEX decimal format that were than converted to WIF format and thus bulk imported into Electrum. Electrum is taking its good ol time synchorizing these private keys. In this process, is has recorded 2421 transactions the first ones occuring in 2011. So 223517 private keys and each one has a unique address. It finally verified an address with transactions, though, the balance is 0.

If view details of the address, I can view the private key in its correct format. I guess my question I wonder is, if these, weren't my addresses or private keys, how would I end up with them on my hard drive? Is it possible when downloading Bitcoin Core and the ledger that the scan program had gathered some of this information of other people's addresses?

In 2009, there was no "gap limit", as that's related to HD wallets. There may not even have been a keypool yet (which was later introduced starting with 100 addresses by default, and later increased to 1000 addresses).

"Most"? If that means some are funded, you found what you're looking for.

If it's from a 2009 wallet.dat that's not loaded to an updated client, then there should only be hundreds to single digit of private keys depending on the Bitcoin client's version.
If it's old but quite newer than the above, then there should be thousands.

It's highly unlikely for your wallet to generate 229,000 private keys if 99% of those aren't used or from multiple wallet files since the default gap limit since then is only 1000.
Chances is that the AI chatbot that you've asked messed up the code to aimlessly search for 256-byte data from the drive.
If you can share the code (between [code][/code] tags), users here can audit if it's actually doing what you've asked the bot.

My question is if I recovered data from my possible wallet, would it contain thousands of private keys? Because that is what my scanner program found and these private keys are verified as bitcoin addresses.

I don't know. I thought it was one address or addresses and one or couple private keys???

I did a private key import and it is showing a little over 229,000 or private keys. So I really don't know what to think, most of the private keys have a 0 balance.

It's hard to believe AI is useful for such specific task, but you have no reason to lie here.


1. Probably no, since key pool feature created back in 2010. See Key pool feature for safer wallet backup.
2. So what is your question? If the private key is in WIF format, you could just import those to Electrum or other wallet which have feature to import bunch of private keys.

Update

Recently I used different AI engines to write me different python bitcoin recovery programs and these programs have found addresses and private keys.
I was really surprised because I didn't think these programs would find anything useful.

Questions:
1. Would old wallet files have hundreds of addresses? Even if you mined lets say a little bit of coin?
2. I have hundreds of addresses and hundreds of private keys. The keys themselves are unencrypted.

I'm still trying to digest all this information and make sense of it all. I have downloaded Electrum and I am also using Bitaddress to correlate the Private Keys to the Addresses.

If you ever made a backup, have you tried system restore from Windows?
Do this on a cloned drive not the original..

Attached images not showing (for me).

This link gives various ways to recover deleted user files. I have not tried them.
https://7datarecovery.com/blog/undelete-user-profile-windows/
Do this on a cloned drive not the original..

There is, here's the code that shows the command line option: https://github.com/jackjack-jj/pywallet/blob/811c6bee054657783e7c2683bdfded5700241e17/pywallet.py#L3939-L3940
You can also refer to that link to check if you're using the official pywallet by jackjack.

Even jackjack himself has posted instructions on how to use the command here: https://bitcointalksearch.org/topic/m.2794856

Great command, though, there isn't a recover command in Jack Jack pywallet. Is there another pywallet you're referring to?

If you want to scan the HDD or raw copy of the HDD directly, use following command


Here's an example (i've tried on my linux device),


Few things to note,

• Make sure folder on parameter --recov_outputdir already created.
• You'll need admin/root permission if you want to scan the drive directly.
• You must specify size of the drive or file manually.

For the following command you need to specify the path to ur wallet-file if you want to use pywallet.
This means: You must already know the path where the wallet.dat is located. So no classic scanning for the whole hard drive.


To explain it:
--dumpwallet will dump the content of the selected wallet file
--datadir specifies the directory where the wallet-file is located
--wallet specifies the path to the wallet.dat
> wallet.txt means that all data that can be extracted will be stored in the wallet.txt

I've installed and looked over Pywallet and it doesn't seem that is can scan for a wallet file. Do you know the command from Pywallet off hand?

Update:

Tried DMDE recovery tool. I find this to be a really powerful tool to search for .dat files.

My programmer friend wants to trace the path to the Bitcoin folder in Linux. He gave me a series of commands to run.

We first want to search the word Bitcoin. This hard drive was also stopped being used in early 2010.

Sure enough I got a number of hits for the word Bitcoin, which, correlates to what we discovered earlier with one of the possible wallet files hex code read out showing the pathway for Bitcoin with wallet.dat.

Tracing the word using Grep command and than finding BlockOffset than running debugfs. Though icheck and inode don't work in NTFS on Linux.

We're trying to find the sector block where the Bitcoin folder/wallet file starts.  Any ideas much appreciated!

https://share.icloud.com/photos/01cQfRfdd9Evfni_X7oKR-oRQd

https://share.icloud.com/photos/01cQfRfdd9Evfni_X7oKR-oRQ

I stopped using the hard drive in early 2010. Other than extracting information from it and deleting files.

Having a re-read of thread.

'The Sleuth Kit' might find the text string GenerateBitcoins or even coin:

https://www.lmgsecurity.com/sleuth-kit/

Hi,

> "Back in the summer of 2009, I downloaded Bitcoin and mined very briefly"

Do you recall what software you used?

As noted above, creating an image of the whole drive before potentially destroying the remnants of your wallet/s would be wise.

You could use 'ddrescue' or 'dd' under Linux, with the source drive attached via the interface of the time (SCSI/SATA/SAS....) to create a disk image. Once complete set the source drive aside for safe storage.

Then mount, read-only, the disk image on a Linux system, see the instructions under the Ubuntu data recovery page.  New to this forum, can I post URLs?

Then try: PhotoRec,Foremost, Scalpel.... being careful to only install from the official repositories, be wary of downloading software not from the official repositories.

If you don't have luck with open source utilities, you could use the following rig to potentially recover the assets, take careful note of instructions:

- Create a Windows VM on a Linux system (KVM...) and install data recovery utilities from any source.
- Shutdown the VM and remove the network interface, assume the system might now be tainted.
- Attach the disk image from earlier, you will need to convert it into something like a qcow file depending on the virtualization software you have used.
- Boot and see what can be recovered with the various utilities.
- Attach an additional disk to move assets out of the rig.
- Assume it might too be tainted so be wary of moving onto a Windows system.
- Eventually move coins to a fresh wallet.

Good luck

John  

      

https://github.com/jackjack-jj/pywallet also have ability to scan for wallet.dat file directly on disk partition. Although i've no idea whether it perform better than FindBTC or not.


Personally i'd suggest https://github.com/cgsecurity/testdisk if you're willing to use cmd/terminal or you can ask your programmer friend to do that for you. But first of all, make sure you already make raw copy of the HDD.


Actually the disk is at least 19 years old, while the data is on it at least for 14 years old.

According to db.cpp from the v0.1 source code, there appear to be the following set of strings written in the wallet.dat:

I quickly spin off a Bitcoin v0.1 to try it out:


(wallet.dat can be downloaded from: https://anonymfile.com/agZe/wallet.dat to check)

You can indeed find strings like 'fGenerateBitcoins' and 'Your Address(...name"'. If you dig up your disk and find these using a hex editor, you're lucky.

Got ya.
There are some parts that are "human-readable" when the wallet.dat is parsed via pywallet or something.
Since the OP didn't specifically talk about it, I assumed he meant the original file. In my previous post I had already mentioned the possibility of pywallet under his second question. There you could then extract exactly such parts from the wallet.

There are parts of it that are actually human-readable when parsed as text.

Like for example, the toggle-able setting: "GenerateBitcoins" is in it.
And the significant: "name" followed by his address which could potentially answer his second question.

There's one step before that: create a disk image, backup the image, and only work on the image.

Indeed. A computer easily writes many terabytes per year to it's disk when you use it. This makes it very unlikely to find back the sector you're looking for.

Seems pretty messed up situation. From my experience, relying on your 14 year old disk to not have written on top of your private keys, usually doesn't go well.

I have never helped someone recover deleted files, so I am not the best to help you in this, but I'd absolutely attempt to recover anything in there. I mean, we're talking about at least 50 BTC; that is a shitload amount of money. The first thing I'd do is use software which allows you to make quick searches on the drive, and I'd look for "wallet.dat". If that does not work, then chances aren't with your side. You should then start searching for uncompressed public keys I guess?

Hi there,


The file would be a binary format, so not really readable for a human.

That would be challenging due to the binary format as mentioned above.
You might wanna use Bitcoin Core if you find that file. That would be the easiest way to import the wallet.dat. Another method would be pywallet.

As @bitmover already said, that file wouldn't be big. From your statement, it also sounds like you haven't been mining for long. The size of the file depends on the generated addresses and their transactions, so it might not have been too much in your case. On top of that there were a lot of things not implemented in 2009 that could make it a larger file. So it should be in the range of a few kilobytes to a few megabytes?


I'm goin to summarize the question as it relates to both.
There are several software such as EaseUS Data Recovery Wizard or Recuva that could lead to success. However, success is not guaranteed especially since it has been a very long time and the deleted data may have already been overwritten with new ones.

The wallet.dat file size depends on the number of addresses you have generated.

I found this thread asking this question about the file size and the information that 1135 bytes per address was confirmed.



I made your images visible here:

Hello,

Back in the summer of 2009, I downloaded Bitcoin and mined very briefly. At the time I had a cutting edge gaming rig and I came across Bitcoin in a new article.  I remember mining Bitcoin and it brought my gaming rig to a crawl. After brief period of time and with Bitcoin being worthless, I uninstalled Bitcoin. A decade later, Bitcoin explodes and it made me think if I had any Bitcoin.

I was really skeptical. I tried many many times over the years to find the wallet.dat file and no luck. Maybe my memory was bad.

I very recently found the JakeWins, FindBTC, Github program to search hard drives that have seen better days. I get my computer programmer friend involved and we run FindBTC on Debian Linux. In 2009, I was using a WD 36GB Raptor drive made in 2004. At 73% of the way into the scan it hits a possible wallet.dat file trace.

The possible wallet.dat file is seperated into four parts. FindBTC gives byte offset numbers where the file exists. We use sector editor to open each wallet file in linux. In wallet file 3, if gives the install location C:/Users/.../start menu/bitcoin/wallet.dat. Appearing to confirm that Bitcoin was installed.

The problem is many years ago, I deleted the Users file on this hard drive.

Questions/Help:
1. What type of wording or language is contained in wallet.dat file from 2009?
2. Using sector editor to read the file, can I locate the address within the file?
3. How large should wallet.dat file be typically from 2009?
4. Any programs to recover a deleted Users file from Windows 7.
5. Any programs exist to recover deleted wallet.dat file.

Please see attached images.
https://share.icloud.com/photos/038socKcaDgEvzbr2BgW99twg
https://share.icloud.com/photos/04b2VtgMIusQWUPG8WUcBzzxw