Topic: Bitcoin Core wallet.dat restore shows wrong amount. (Read 371 times)

Yeah, I let Dave know as soon as I was in but he said he was not currently working on it after a first pass.

Congratulations,
you might want to contact the service where you've given the other wallet.dat because he might still be working on its password.

There's a "lock topic" button below (lower-left) if you think this thread's issue is solved.

FYI - I found an old backup of the wallet on my work laptop of all places and its file name gave me a clue about the correct pass phrase and after 30 tries or so I got it. 

Dave is now working on finding the password. Maybe he will get lucky and find it soon. Just makes me mad that I have no real recollection of what password I used from just three years ago and that I did make an unencrypted backup but not after the last transaction and that I did not leave a clue to the password or something. Getting old stinks.

If that's the case, get all of your addresses with balance from the result of:

Open the console (Window->Console) and type that command:
All of your used addresses including change will show up there, the associated balance will display below each addresses.

The problem with the solution offered by BitMaxz, is that I suspect the bulk of your coins are on a change address... NOT a receiving address. Bitcoin Core treats change addresses as "internal only" and tends to hide their existence from you. As such, change addresses will NOT be displayed in the "Receiving Addresses" list


However, you can actually get Bitcoin Core to display ALL your current "Unspent Transaction Outputs" (aka UTXOs) in a fairly easy manner...

1. Set Bitcoin Core to enable "Coin Control Features"
- Goto: Settings -> Options:



- Select the "Wallet" tab... and make sure that "Enable Coin Control Features" is TICKED:



2. View all available UTXOs:
- On the main Bitcoin Core screen, select the "Send" Tab:



- You should now see the new section at the top labelled "Coin Control Features"... click the "Inputs..." button:


Assuming that your Bitcoin Core is fully synced and scanned (like your encrypted wallet should be), You'll see a list of all the coins that your wallet believes are currently available to be spent by your wallet. You will also see any "change" addresses listed with the label "(change)" as per the screenshot above. By default, "receive" addresses will tend to have "(no label)", but they can also have user-defined labels if one was manually added.

Each UTXO will also have the associated address listed with it... which you can easily copy by right clicking on the appropriate line and selecting "copy address" from the pop up menu... you can then paste the address into the blockexplorer of your choice to confirm that the coins/balance are correct etc.

You can also get the Transaction ID for the transaction that created that specific UTXO from the same pop up menu.


Hopefully, this method will allow you to see exactly which addresses your coins are currently associated with, and whether those addresses are "change" addresses, or "receive" addresses.

Sorry, I'm just not good at this stuff and without the last post I'd not know about the receiving addresses list and so on.

There are 6 receiving addresses listed.

Only two show a received and sent amount and just one has a final balance of 0.00010000 BTC. The one with a final balance has an amount received that does look like the amount I original stated with in 2012.

That 0.00010000 BTC doesn't match the match the encrypted or the old unencrypted amount.

But I've had this VM saved from the last time I used it and the wallet shows the correct amount even after syncing the blockchain up to date.

I'll try sending Dave the CSV.


Thanks for putting up with me.

You just make things complicated why you don't check all addresses on receiving address from an encrypted wallet?

Here's the reference



Gather all addresses from that tab and paste it to notepad as I said recently.
You can check them one by one if what address has balance and calculate it in total so that you can provide it on http://walletrecoveryservices.com/
Dave wants to know if it's worth recovering or it's another wallet.dat file with a fake balance. There are lots of fake wallet.dat(lost password) out there with a huge amount of BTC balance selling on the market. So dave just wants to know if your wallet is not one of them.

If you can provide enough evidence that it has a balance then they will grab it and take the 15%-%20 of the fee after recovery.

You can also do what LoyceV said above and export all transactions in .csv you can provide them to Dave for analysis including all addresses from receiving address tab.

Thanks for your patience.

"just use the output address that you found from the last send transaction"
Got the last Transaction ID from the encrypted wallet and then got the 2 output addresses the second one has the "ismine: true"

I then use that output address on blockchain.com? It has almost no coin listed???

don't use the getaccountaddress command... just use the output address that you found from the last send transaction that shows "ismine: true" in the "encrypted" wallet.dat (and "ismine: false" in the old wallet.dat)... That address is where the "missing" coins are.

Then simply search that address on blockchain.com and see what the history/balance of that address is.


Also, I suspect you're using an old version of Bitcoin Core... getaccountaddress was deprecated several versions ago (v0.17 and removed in v0.18)...

Yes to most of those and I've made a list and tried all I can think of with the change passphrase option.

I've sent a message to Dave and he asked that I verify whether the encrypted is legit by looking up one of the addresses holding BTC. I was just trying to do as he asked but not sure I've done it right.

I tried using the getaccountaddress "" command but when I put the output into blockchain.com I get this for the BTC address and BCH address:

This address has transacted 0 times on the Bitcoin blockchain. It has received a total of 0.00000000 BTC ($0.00) and has sent a total of 0.00000000 BTC ($0.00). The current value of this address is 0.00000000 BTC ($0.00).

As I suspected... at some point after adding the encryption passphrase to the wallet.dat, you have then spent some coins using the "encrypted" wallet.dat... and that transaction has created "change" which was sent to a "change" address that is not in your "old unencrypted" wallet.dat

Effectively, the only way you're going to be able to recover all your coins, is to recover your wallet passphrase... All this to-ing and fro-ing with checking address balances and stuff really doesn't matter.

You've synced the blockchain, and you've rescanned the "encrypted" wallet.dat... you can be confident that the balance it is showing is "correct". However, without the wallet passphrase, you're not going to be able to get the full balance... as there are coins controlled by private keys that you cannot access. As, you have limited access to some of the keys with the "unencrypted" wallet.dat, then you'll only be able to get the balance that is shown in the "unencrypted" wallet (assuming that the unencrypted wallet has been fully synced/rescanned).

---

So, it now boils down to this:

- Do you have any idea at all what the passphrase might be?
- Did you ever make notes about your passwords?
- Did you use a common set of passphrases for things back when you were using these wallets?
- Did you use a common "structure" to your passphrases (ie. 6 chars starting with 1 uppercase + 4 numbers)?
- Were your passphrases relatively short (<=10 chars)?
- Just letters+numbers or did you use "special" characters like !@#$%^&*()_+ etc?

Your chances of recovering the passphrase depend on the answers to these questions.

I have done that a few times but Dave said: "You should be able to verify whether it's legit by looking up one of the addresses holding BTC on blockchain.com to verify the current balance."

And I tried using the getaccountaddress "" command but when I put the output into blockchain.com I get this for the BTC address and BCH address:

This address has transacted 0 times on the Bitcoin blockchain. It has received a total of 0.00000000 BTC ($0.00) and has sent a total of 0.00000000 BTC ($0.00). The current value of this address is 0.00000000 BTC ($0.00).

Has it really been zeroed out somehow?

Load it in Bitcoin Core, and let it synchronize the blockchain. It's easy, but slow.

They are both the same wallet. One is old and unencrypted. I don't want to really move them I was just hoping there was a to update the old unencrypted wallet and get access to the coins. But the old unencrypted wallet is missing the last few transactions that the encrypted wallet has. It sound like no as HCP said when I encrypted wallet for safety reason, it resets the seed/keypool, generates a bunch of new keys/addresses and then "archives" the old keys/addresses (marks them as inactive so they don't get "used" when you generate a new address to receive or for change).

As it looks like there is no way to update the unencrypted version of the wallet. I'd like to know how to simply verify the amount in the encrypted wallet so I can maybe try to work with Dave at http://walletrecoveryservices.com/.

No, I didn't say that, I was actually focused on getaddressinfo command this command only use to get the info of the address and to know if your wallet.dat holds its private key.

---

If you can publicly post the whole transaction history here both from your new wallet and from the wallet in your VM then maybe we can analyze why you get 0.013 remaining balance after you restore it with the latest version.


What actually your purpose? Do you want to get the whole balance the same as what you see from your wallet in VM?
Or your purpose is to withdraw them all and transfer them to another wallet?

If you want to transfer them to another wallet then you can just copy all addresses from your wallet in VM(With the correct balance). Click the "window" and then "receiving addresses" it must show all of your used addresses including the change address. Collect them and put them to notepad and then check them one by one on http://blockchain.com/ to check each of these addresses has balance and calculate them in total.

If the total balance is correct after you calculate it there is a problem with your old wallet.dat file backup there might be a missing address on that wallet after you imported it to the latest bitcoin core. Possible in that time you might be generated a new receiving address after the backup and the missing BTC is in newly generated address.


If all suggestion above doesn't work the only solution that I can see here is to brute-force the wallet.dat file where the BTC balance is correct.
There is a tool called BTCrecover that you can use to brute-force the wallet file you can find it from here https://github.com/gurnec/btcrecover
Or take the service of http://walletrecoveryservices.com/

How to I verify the amount in encrypted wallet is correct with blockchain.com?

I tried using the getaccountaddress "" command but when I put the output into blockchain.com I get this for the BTC address and BCH address:

This address has transacted 0 times on the Bitcoin blockchain. It has received a total of 0.00000000 BTC ($0.00) and has sent a total of 0.00000000 BTC ($0.00). The current value of this address is 0.00000000 BTC ($0.00).

Has it really been zeroed out somehow?

Correct. Just unselect Prune, and restart Bitcoin Core. It will take a while to download, verify and store 400 GB.

Is there a way to un-prune the wallet? Just let a new install of the Core Wallet download all the blockchain without a wallet loaded?

How to I verify the amount in encrypted wallet is correct with blockchain.com?

The last transaction has two output address. It's a little confusing as the last day on the unencrypted wallet I had some sent transactions that I was having an issue sending they and the receiver later returned one. The ID and amount are the same in both but the date/time stamp differs by 4 hours or so.

Unencrypted Wallet
Both outputs have "ismine": false.

Encrypted Wallet
First output has "ismine": false.

Second output has "ismine": true with more info like, "desc" and "pubkey".


BitMaxz had said there was a chance to update the Unencrypted Wallet? But I'm not sure what he is asking to do here.

"Try to add the change address at the end and let see if the result is true or not. If it shows true then you have a chance to get the private key of the change address where your BTC missing."

oh... you're running a pruned wallet... that could potentially be problematic with attempting to "sync" (ie. rescan) a wallet.dat file... Bitcoin Core can't scan blocks it doesn't have on disk... so if your node is pruned, it can't scan the pruned blocks... hence the error message about needing to "reindex" (and redownload the missing blocks).

However, using the getaddressinfo should still identify which address you have the private keys to... regardless of whether the wallet.dat is properly synced (rescanned) or not... and regardless of whether or not the node is pruned... and regardless of whether or not the node is fully synced (ie. all blocks downloaded/indexed)

How many output addresses where in the last send transaction? One... or two?

If there is only one, then it's likely an external address... so try going back to the next "Send" transaction... and find the output addresses from that and check those... you're really trying to find the most "send" transaction that has at least two output addresses.