Author

Topic: Content of wallet.dat - Bounty (Read 4004 times)

hero member
Activity: 672
Merit: 504
a.k.a. gurnec on GitHub
September 03, 2014, 11:24:02 AM
#42
Yeah actually that's a very good idea.

And you can simply do (without globstar)
Code:
find ./ -type f -exec file {} \; | grep "Berkeley DB"
(And replace ./ with the directory path)

I'm getting this error back:

find: missing argument to '-exec'  I guess something's missing from the line?

You probably need to escape the braces, like this:
Code:
find ./ -type f -exec file \{\} \; | grep "Berkeley DB"
member
Activity: 72
Merit: 10
42
September 03, 2014, 08:15:58 AM
#41
Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)
Code:
find ./ -type f -exec file {} \; | grep "Berkeley DB"
(And replace ./ with the directory path)

I'm getting this error back:

find: missing argument to '-exec'  I guess something's missing from the line?

If you copy pasted it properly shouldn't have any problems..
sr. member
Activity: 280
Merit: 250
August 15, 2014, 09:30:57 AM
#40
Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)
Code:
find ./ -type f -exec file {} \; | grep "Berkeley DB"
(And replace ./ with the directory path)

I'm getting this error back:

find: missing argument to '-exec'  I guess something's missing from the line?
sr. member
Activity: 280
Merit: 250
August 14, 2014, 10:44:13 PM
#39
Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)
Code:
find ./ -type f -exec file {} \; | grep "Berkeley DB"
(And replace ./ with the directory path)

Sweet!!! Will try this next Smiley
sr. member
Activity: 280
Merit: 250
August 14, 2014, 10:43:42 PM
#38
Did you already get your wallet data back?
I had this problem as well, using a simple recovery tool. Anything should work really.
I hope you get yours back!

Thanks! I haven't yet, but here's hoping!
sr. member
Activity: 280
Merit: 250
August 14, 2014, 10:41:08 PM
#37
Try Recuva recovery software and search for wallet.dat or just type .dat you can search it in specific participation, you can also search for any other format you need for.

I think I tried that - I think it's only for Windows. But even so, the majority of the files I recovered extension was renamed to .txt.
sr. member
Activity: 467
Merit: 250
August 14, 2014, 05:46:06 AM
#36
Try Recuva recovery software and search for wallet.dat or just type .dat you can search it in specific participation, you can also search for any other format you need for.
full member
Activity: 297
Merit: 100
August 14, 2014, 04:32:26 AM
#35
Did you already get your wallet data back?
I had this problem as well, using a simple recovery tool. Anything should work really.
I hope you get yours back!
member
Activity: 72
Merit: 10
42
August 13, 2014, 07:05:06 AM
#34
Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)
Code:
find ./ -type f -exec file {} \; | grep "Berkeley DB"
(And replace ./ with the directory path)
hero member
Activity: 508
Merit: 500
Techwolf on #bitcoin and Reddit
August 13, 2014, 06:09:51 AM
#33
Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).
hero member
Activity: 560
Merit: 509
I prefer Zakir over Muhammed when mentioning me!
August 10, 2014, 07:20:45 AM
#32
Thanks... but I don't even know my addresses.
Your post history does (only had a quick look):
16K6t4BtQwhbeTBaRrocCuptESyKcXTcuZ
1BUJ92LbERYLEPxfaxcRJECm5rXYasvsxE

Nice detective work Smiley  But those are from my online wallet... This is a new system I built a couple of months ago to start to start hosting pools so I had to download the client.

Try checking history of your browser. Somehow if you checked your balance of an address in blockchain or any other exploerer, you might get it from browser.

Kindly,
      MZ
sr. member
Activity: 280
Merit: 250
August 10, 2014, 01:08:06 AM
#31
Wouldn't you only need the private address? no need for the public one if you have the private one, correct? I hope you are able to find your cons, I know it sucks to lose coins from technical issues.

I have to find the wallet.dat files first! Tongue  Here's hoping Smiley  I was able to find a couple of my most precious files... my index.html and style css for my website. Lots of me went into those... they're not the latest iteration, but at least I can work from that. Tomorrow I'll work on the wallet.dats.
hero member
Activity: 924
Merit: 1000
August 09, 2014, 11:42:19 PM
#30
Wouldn't you only need the private address? no need for the public one if you have the private one, correct? I hope you are able to find your cons, I know it sucks to lose coins from technical issues.
sr. member
Activity: 280
Merit: 250
August 09, 2014, 10:03:01 PM
#29
How much do you have in those wallets, if you don't mind me asking!

10s of 1000s of a few pretty much worthless coins
sr. member
Activity: 430
Merit: 250
Agent of Chaos
August 09, 2014, 09:37:35 PM
#28
How much do you have in those wallets, if you don't mind me asking!
member
Activity: 72
Merit: 10
August 09, 2014, 03:30:41 PM
#27
nearly all cryptocoins use the DB Berkeley format

science
sr. member
Activity: 280
Merit: 250
August 09, 2014, 03:03:46 PM
#26
Hi!

Here are the sig for DB Berkeley (wallet.dat) add it to photorec and run it again...
Code:

dat 0x0 0x00061561
dat 0x0 0x61150600
dat 0x0 0x00053162
dat 0x0 0x62310500
dat 0xc 0x00061561
dat 0xc 0x61150600
dat 0xc 0x00053162
dat 0xc 0x62310500
dat 0xc 0x00042253
dat 0xc 0x53220400
dat 0xc 0x00040988
dat 0xc 0x88090400

Science

Sweet! So I do have to run it again... guess I'll go ahead and stop this session. Before I do though, I want to see if FaSan's method of using keyhunter is faster than Photorec. It's been running now for 17hours and says I still have 6 hours left. I'm scanning the entire disk.

EDIT - this might be a stupid question... do all wallets use this signature, or will this only find my bitcoin wallat.dat?
member
Activity: 72
Merit: 10
August 09, 2014, 02:41:53 PM
#25
Hi!


Here are the sig for DB Berkeley (wallet.dat) add it to photorec and run it again...
Code:

dat 0x0 0x00061561
dat 0x0 0x61150600
dat 0x0 0x00053162
dat 0x0 0x62310500
dat 0xc 0x00061561
dat 0xc 0x61150600
dat 0xc 0x00053162
dat 0xc 0x62310500
dat 0xc 0x00042253
dat 0xc 0x53220400
dat 0xc 0x00040988
dat 0xc 0x88090400

Science
sr. member
Activity: 280
Merit: 250
August 09, 2014, 02:29:46 PM
#24
So I've already ran Photorec (this is second time around actually - 6 hours left). Do I have to run it again so that the wallet.dat signature file can be included in the recovery? I was under the impression that maybe they'd be in the 1mil files I got on the first run, just perhaps a .txt format....

Didn't you get a backup in the external drive? then just run (assuming you are on ubuntu now)
Code:
grep -RH 'defaultkey' EXTERNAL_DRIVE
Against your backed up files, and it will get the wallets for you no matter what their name/extension is.

(And put the real path of the external drive instead of EXTERNAL_DRIVE)

Ah! Yes, Photorec saved all of my copied files over to my external drive. But because they're a default file signature type I was asking whether the wallet files were recovered to begin with. It looks like you have to add a custom signature prior to running Photorec so the files can be included in the recovery:

http://www.cgsecurity.org/wiki/Add_your_own_extension_to_PhotoRec
member
Activity: 72
Merit: 10
42
August 09, 2014, 02:21:54 PM
#23
So I've already ran Photorec (this is second time around actually - 6 hours left). Do I have to run it again so that the wallet.dat signature file can be included in the recovery? I was under the impression that maybe they'd be in the 1mil files I got on the first run, just perhaps a .txt format....

Didn't you get a backup in the external drive? then just run (assuming you are on ubuntu now)
Code:
grep -RH 'defaultkey' EXTERNAL_DRIVE
Against your backed up files, and it will get the wallets for you no matter what their name/extension is.

(And put the real path of the external drive instead of EXTERNAL_DRIVE)
sr. member
Activity: 280
Merit: 250
August 09, 2014, 02:09:13 PM
#22
lucky did u ever look at the link i post before?? there u can find the answer

science

So I've already ran Photorec (this is second time around actually - 6 hours left). Do I have to run it again so that the wallet.dat signature file can be included in the recovery? I was under the impression that maybe they'd be in the 1mil files I got on the first run, just perhaps a .txt format....
sr. member
Activity: 280
Merit: 250
August 09, 2014, 02:05:58 PM
#21
Thanks! But I have about 20 different coins... I guess I'll have to try and match which key goes to what wallet?
import every private key to every wallet. you can import keys using RPC or command line so it shouldn't be too tedious.

Holy crap - didn't know this. Man you guys are going to take my bitchange, lol. But it's cool Smiley

Just so you guys know... I'm going to try everything I can obviously. You guys gave me lots of direction here... so you'll end of splitting the bounty.
sr. member
Activity: 280
Merit: 250
August 09, 2014, 01:52:15 PM
#20
Thanks... but I don't even know my addresses.
Your post history does (only had a quick look):
16K6t4BtQwhbeTBaRrocCuptESyKcXTcuZ
1BUJ92LbERYLEPxfaxcRJECm5rXYasvsxE

Nice detective work Smiley  But those are from my online wallet... This is a new system I built a couple of months ago to start to start hosting pools so I had to download the client.
sr. member
Activity: 280
Merit: 250
August 09, 2014, 01:50:16 PM
#19

Holy smokes! So this will actually rename them to wallet.dats for me... and I can then use Newar's suggestion to peer inside the files to see addresses/labels maybe? Do wallet.dats have the coin name mentioned in them? that could help.

So to use this, it looks like I have to install fidentify? Can I assume that the wallet file extension was also located in the /usr/share/misc/magic directory as well?

Perhaps I should've mentioned that after I copied all files to my external drive, I reinstalled unbuntu... don't ask me why I didn't just take the damn hard drive and confirm the files were there before doing that. Coulda, woulda, shoulda doesn't help me now, it was an oversight, I was tired as hell. Anyhoo, I guess that's why Testdisk couldn't help me and I had to use Photorec.
legendary
Activity: 1358
Merit: 1001
https://gliph.me/hUF
August 09, 2014, 01:39:32 PM
#18
Thanks... but I don't even know my addresses.

Your post history does (only had a quick look):
16K6t4BtQwhbeTBaRrocCuptESyKcXTcuZ
1BUJ92LbERYLEPxfaxcRJECm5rXYasvsxE
legendary
Activity: 2058
Merit: 1431
August 09, 2014, 01:38:19 PM
#17
Thanks! But I have about 20 different coins... I guess I'll have to try and match which key goes to what wallet?
import every private key to every wallet. you can import keys using RPC or command line so it shouldn't be too tedious.
sr. member
Activity: 280
Merit: 250
August 09, 2014, 01:38:11 PM
#16
lucky did u ever look at the link i post before?? there u can find the answer

science
I was just about to respond to you Smiley  I see the link but haven't read it yet. Thanks for providing it Smiley
sr. member
Activity: 280
Merit: 250
August 09, 2014, 01:37:31 PM
#15
I looked at an encrypted wallet using medit and the addresses and labels of addresses at least are there in plain text.

Thanks! I'll check this out once I find the files.
member
Activity: 72
Merit: 10
August 09, 2014, 01:37:07 PM
#14
lucky did u ever look at the link i post before?? there u can find the answer


science
sr. member
Activity: 280
Merit: 250
August 09, 2014, 01:36:48 PM
#13

Excellent! So the output would be the balance and I can just pluck the keys that have balances?


No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.

FaSan

Oh, ok. Forgive me... not much of a techie. But once I get the private keys, then what? Fingers crossed that all of my important wallet.dats are recoverable - aren't the private keys in that file? Guess I'm not sure how to use this script.

Simple start it and wait. After take the list of privatekeys founded and re-import on another wallet. If you lucky, you take back all your bitcoins.

FaSan

Thanks! But I have about 20 different coins... I guess I'll have to try and match which key goes to what wallet?
sr. member
Activity: 280
Merit: 250
August 09, 2014, 01:35:03 PM
#12
If you open the wallet.dat in notepad the generic line would be like this:
name"ADDRESS here

I'm sure I'll have hundreds of wallet.dats, with only one being the one I need.

Is it a vanilla wallet or encrypted?

If it's plain normal wallet.dat then the old wallet can access the new coins. Not sure about encrypted wallets or wallets for tools other than bitcoinQT


Edit:

Other strings in my wallet:
minversion
defaultkey
version
setting
addrIncoming
minversion
defaultkey
version
setting
addrIncoming

I have some not encrypted, but of course my bitcoins are. Are you able to provide a string? Grep's going to pull every document that has those words... that's why I need a string of text.
sr. member
Activity: 280
Merit: 250
August 09, 2014, 01:33:39 PM
#11
Try searching anything related to this:

Quote
The original Bitcoin client wallet file is named wallet.dat and contains[1]:

keypairs for each of your addresses
transactions done from/to your addresses
user preferences
default key
reserve keys
accounts
a version number
Key pool
Since 0.3.21: information about the current best chain, to be able to rescan automatically when restoring from a backup.

Kindly,
       MZ

Thanks... but I don't even know my addresses.
legendary
Activity: 1358
Merit: 1001
https://gliph.me/hUF
August 09, 2014, 01:08:49 PM
#10
I looked at an encrypted wallet using medit and the addresses and labels of addresses at least are there in plain text.
member
Activity: 72
Merit: 10
hero member
Activity: 560
Merit: 509
I prefer Zakir over Muhammed when mentioning me!
August 09, 2014, 01:01:12 PM
#8
Try searching anything related to this:

Quote
The original Bitcoin client wallet file is named wallet.dat and contains[1]:

keypairs for each of your addresses
transactions done from/to your addresses
user preferences
default key
reserve keys
accounts
a version number
Key pool
Since 0.3.21: information about the current best chain, to be able to rescan automatically when restoring from a backup.

Kindly,
       MZ
member
Activity: 72
Merit: 10
42
August 09, 2014, 12:58:16 PM
#7
If you open the wallet.dat in notepad the generic line would be like this:
name"ADDRESS here

I'm sure I'll have hundreds of wallet.dats, with only one being the one I need.

Is it a vanilla wallet or encrypted?

If it's plain normal wallet.dat then the old wallet can access the new coins. Not sure about encrypted wallets or wallets for tools other than bitcoinQT


Edit:

Other strings in my wallet:
minversion
defaultkey
version
setting
addrIncoming
minversion
defaultkey
version
setting
addrIncoming
hero member
Activity: 658
Merit: 502
August 09, 2014, 12:57:17 PM
#6

Excellent! So the output would be the balance and I can just pluck the keys that have balances?


No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.

FaSan

Oh, ok. Forgive me... not much of a techie. But once I get the private keys, then what? Fingers crossed that all of my important wallet.dats are recoverable - aren't the private keys in that file? Guess I'm not sure how to use this script.


Simple start it and wait. After take the list of privatekeys founded and re-import on another wallet. If you lucky, you take back all your bitcoins.




FaSan
sr. member
Activity: 280
Merit: 250
August 09, 2014, 12:55:31 PM
#5

Excellent! So the output would be the balance and I can just pluck the keys that have balances?


No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.

FaSan

Oh, ok. Forgive me... not much of a techie. But once I get the private keys, then what? Fingers crossed that all of my important wallet.dats are recoverable - aren't the private keys in that file? Guess I'm not sure how to use this script.
hero member
Activity: 658
Merit: 502
August 09, 2014, 12:52:47 PM
#4

Excellent! So the output would be the balance and I can just pluck the keys that have balances?


No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.



FaSan
sr. member
Activity: 280
Merit: 250
August 09, 2014, 12:50:56 PM
#3

Excellent! So the output would be the balance and I can just pluck the keys that have balances?
hero member
Activity: 658
Merit: 502
August 09, 2014, 12:48:27 PM
#2
sr. member
Activity: 280
Merit: 250
August 09, 2014, 12:45:07 PM
#1
I need some help...

Long story short - lost all data on my hard drive and my external back drive.

I ran Photorec and recovered over 1 million files from hard drive, and if any of you has ever had to do that (so sorry)... you know the files are recovered with a generic name and most extensions are changed to txt.

Anyhoo - to locate wallets in the abyss, I can search the content of the files (grep recursive), but I don't have a freakin clue what's in a wallet.dat; never tried to open one.

That said - does anyone have some generic line of text from a wallet.dat that I can use to query a mil+ freakin txt files? I'm sure it's going to recover wallet.dat from backups, the trash, and even temp directories. I'm sure I'll have hundreds of wallet.dats, with only one being the one I need. So wondering... once I locate these files (fingers crossed), is there a way to identify the coin they belong to or date it was last updated or something?

Someone please help!

About the bounty - If you hadn't guessed by now my coins are on this hard drive. But I do have a lil bitchange in an exchange wallet that I'm willing to share.
Jump to: