Topic: Content of wallet.dat - Bounty (Read 4021 times)

Quote from: Lucky Cris on August 15, 2014, 08:30:57 AM

Yeah actually that's a very good idea.

And you can simply do (without globstar)

Code:

find ./ -type f -exec file {} \; | grep "Berkeley DB"

(And replace ./ with the directory path)

I'm getting this error back:

find: missing argument to '-exec' I guess something's missing from the line?

You probably need to escape the braces, like this:

Code:

find ./ -type f -exec file \{\} \; | grep "Berkeley DB"

0xAli

member

Activity: 72

Merit: 10

42

Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)

Code:

find ./ -type f -exec file {} \; | grep "Berkeley DB"

(And replace ./ with the directory path)

I'm getting this error back:

find: missing argument to '-exec' I guess something's missing from the line?

If you copy pasted it properly shouldn't have any problems..

Lucky Cris

sr. member

Activity: 280

Merit: 250

Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)

Code:

find ./ -type f -exec file {} \; | grep "Berkeley DB"

(And replace ./ with the directory path)

I'm getting this error back:

find: missing argument to '-exec' I guess something's missing from the line?

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: Nexigen on August 14, 2014, 03:32:26 AM

Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)

Code:

find ./ -type f -exec file {} \; | grep "Berkeley DB"

(And replace ./ with the directory path)

Sweet!!! Will try this next

Lucky Cris

sr. member

Activity: 280

Merit: 250

Did you already get your wallet data back?
I had this problem as well, using a simple recovery tool. Anything should work really.
I hope you get yours back!

Thanks! I haven't yet, but here's hoping!

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: zahra4571 on August 14, 2014, 04:46:06 AM

Try Recuva recovery software and search for wallet.dat or just type .dat you can search it in specific participation, you can also search for any other format you need for.

I think I tried that - I think it's only for Windows. But even so, the majority of the files I recovered extension was renamed to .txt.

zahra4571

sr. member

Activity: 467

Merit: 250

Try Recuva recovery software and search for wallet.dat or just type .dat you can search it in specific participation, you can also search for any other format you need for.

Nexigen

full member

Activity: 297

Merit: 100

Did you already get your wallet data back?
I had this problem as well, using a simple recovery tool. Anything should work really.
I hope you get yours back!

0xAli

member

Activity: 72

Merit: 10

42

Quote from: Lucky Cris on August 09, 2014, 12:52:15 PM

Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)

Code:

find ./ -type f -exec file {} \; | grep "Berkeley DB"

(And replace ./ with the directory path)

Dare

hero member

Activity: 508

Merit: 500

Techwolf on #bitcoin and Reddit

Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Muhammed Zakir

hero member

Activity: 560

Merit: 509

I prefer Zakir over Muhammed when mentioning me!

Quote from: Newar on August 09, 2014, 12:39:32 PM

Quote from: Lucky Cris on August 09, 2014, 12:33:39 PM

Thanks... but I don't even know my addresses.

Your post history does (only had a quick look):
16K6t4BtQwhbeTBaRrocCuptESyKcXTcuZ
1BUJ92LbERYLEPxfaxcRJECm5rXYasvsxE

Nice detective work

But those are from my online wallet... This is a new system I built a couple of months ago to start to start hosting pools so I had to download the client.

Try checking history of your browser. Somehow if you checked your balance of an address in blockchain or any other exploerer, you might get it from browser.

Kindly,
MZ

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: bigasic on August 09, 2014, 10:42:19 PM

Wouldn't you only need the private address? no need for the public one if you have the private one, correct? I hope you are able to find your cons, I know it sucks to lose coins from technical issues.

I have to find the wallet.dat files first! Tongue

Here's hoping

I was able to find a couple of my most precious files... my index.html and style css for my website. Lots of me went into those... they're not the latest iteration, but at least I can work from that. Tomorrow I'll work on the wallet.dats.

bigasic

hero member

Activity: 924

Merit: 1000

Wouldn't you only need the private address? no need for the public one if you have the private one, correct? I hope you are able to find your cons, I know it sucks to lose coins from technical issues.

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: harlenadler on August 09, 2014, 08:37:35 PM

How much do you have in those wallets, if you don't mind me asking!

10s of 1000s of a few pretty much worthless coins

harlenadler

sr. member

Activity: 430

Merit: 250

Agent of Chaos

How much do you have in those wallets, if you don't mind me asking!

science

member

Activity: 72

Merit: 10

nearly all cryptocoins use the DB Berkeley format

science

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: science on August 09, 2014, 01:41:53 PM

Hi!

Here are the sig for DB Berkeley (wallet.dat) add it to photorec and run it again...

Code:


dat 0x0 0x00061561
dat 0x0 0x61150600
dat 0x0 0x00053162
dat 0x0 0x62310500
dat 0xc 0x00061561
dat 0xc 0x61150600
dat 0xc 0x00053162
dat 0xc 0x62310500
dat 0xc 0x00042253
dat 0xc 0x53220400
dat 0xc 0x00040988
dat 0xc 0x88090400

Science

Sweet! So I do have to run it again... guess I'll go ahead and stop this session. Before I do though, I want to see if FaSan's method of using keyhunter is faster than Photorec. It's been running now for 17hours and says I still have 6 hours left. I'm scanning the entire disk.

EDIT - this might be a stupid question... do all wallets use this signature, or will this only find my bitcoin wallat.dat?

science

member

Activity: 72

Merit: 10

Hi!

Here are the sig for DB Berkeley (wallet.dat) add it to photorec and run it again...

Code:


dat 0x0 0x00061561
dat 0x0 0x61150600
dat 0x0 0x00053162
dat 0x0 0x62310500
dat 0xc 0x00061561
dat 0xc 0x61150600
dat 0xc 0x00053162
dat 0xc 0x62310500
dat 0xc 0x00042253
dat 0xc 0x53220400
dat 0xc 0x00040988
dat 0xc 0x88090400

Science

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: 0xAli on August 09, 2014, 01:21:54 PM

Quote from: Lucky Cris on August 09, 2014, 01:09:13 PM

So I've already ran Photorec (this is second time around actually - 6 hours left). Do I have to run it again so that the wallet.dat signature file can be included in the recovery? I was under the impression that maybe they'd be in the 1mil files I got on the first run, just perhaps a .txt format....

Didn't you get a backup in the external drive? then just run (assuming you are on ubuntu now)

Code:

grep -RH 'defaultkey' EXTERNAL_DRIVE

Against your backed up files, and it will get the wallets for you no matter what their name/extension is.

(And put the real path of the external drive instead of EXTERNAL_DRIVE)

Ah! Yes, Photorec saved all of my copied files over to my external drive. But because they're a default file signature type I was asking whether the wallet files were recovered to begin with. It looks like you have to add a custom signature prior to running Photorec so the files can be included in the recovery:

http://www.cgsecurity.org/wiki/Add_your_own_extension_to_PhotoRec

0xAli

member

Activity: 72

Merit: 10

42

Quote from: Lucky Cris on August 09, 2014, 01:09:13 PM

So I've already ran Photorec (this is second time around actually - 6 hours left). Do I have to run it again so that the wallet.dat signature file can be included in the recovery? I was under the impression that maybe they'd be in the 1mil files I got on the first run, just perhaps a .txt format....

Didn't you get a backup in the external drive? then just run (assuming you are on ubuntu now)

Code:

grep -RH 'defaultkey' EXTERNAL_DRIVE

Against your backed up files, and it will get the wallets for you no matter what their name/extension is.

(And put the real path of the external drive instead of EXTERNAL_DRIVE)

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: science on August 09, 2014, 12:37:07 PM

lucky did u ever look at the link i post before?? there u can find the answer

science

So I've already ran Photorec (this is second time around actually - 6 hours left). Do I have to run it again so that the wallet.dat signature file can be included in the recovery? I was under the impression that maybe they'd be in the 1mil files I got on the first run, just perhaps a .txt format....

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: grue on August 09, 2014, 12:38:19 PM

Quote from: Lucky Cris on August 09, 2014, 12:36:48 PM

Thanks! But I have about 20 different coins... I guess I'll have to try and match which key goes to what wallet?

import every private key to every wallet. you can import keys using RPC or command line so it shouldn't be too tedious.

Holy crap - didn't know this. Man you guys are going to take my bitchange, lol. But it's cool

Just so you guys know... I'm going to try everything I can obviously. You guys gave me lots of direction here... so you'll end of splitting the bounty.

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: Newar on August 09, 2014, 12:39:32 PM

Quote from: Lucky Cris on August 09, 2014, 12:33:39 PM

Thanks... but I don't even know my addresses.

Your post history does (only had a quick look):
16K6t4BtQwhbeTBaRrocCuptESyKcXTcuZ
1BUJ92LbERYLEPxfaxcRJECm5rXYasvsxE

Nice detective work

But those are from my online wallet... This is a new system I built a couple of months ago to start to start hosting pools so I had to download the client.

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: science on August 09, 2014, 12:02:45 PM

have a look here ....

http://blog.cyplo.net/2012/04/01/bitcoin-wallet-recovery-photorec/

science

Holy smokes! So this will actually rename them to wallet.dats for me... and I can then use Newar's suggestion to peer inside the files to see addresses/labels maybe? Do wallet.dats have the coin name mentioned in them? that could help.

So to use this, it looks like I have to install fidentify? Can I assume that the wallet file extension was also located in the /usr/share/misc/magic directory as well?

Perhaps I should've mentioned that after I copied all files to my external drive, I reinstalled unbuntu... don't ask me why I didn't just take the damn hard drive and confirm the files were there before doing that. Coulda, woulda, shoulda doesn't help me now, it was an oversight, I was tired as hell. Anyhoo, I guess that's why Testdisk couldn't help me and I had to use Photorec.

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

Quote from: Lucky Cris on August 09, 2014, 12:33:39 PM

Thanks... but I don't even know my addresses.

Your post history does (only had a quick look):
16K6t4BtQwhbeTBaRrocCuptESyKcXTcuZ
1BUJ92LbERYLEPxfaxcRJECm5rXYasvsxE

grue

legendary

Activity: 2058

Merit: 1452

Quote from: Lucky Cris on August 09, 2014, 12:36:48 PM

Thanks! But I have about 20 different coins... I guess I'll have to try and match which key goes to what wallet?

import every private key to every wallet. you can import keys using RPC or command line so it shouldn't be too tedious.

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: science on August 09, 2014, 12:37:07 PM

lucky did u ever look at the link i post before?? there u can find the answer

science

I was just about to respond to you

I see the link but haven't read it yet. Thanks for providing it

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: Newar on August 09, 2014, 12:08:49 PM

I looked at an encrypted wallet using medit and the addresses and labels of addresses at least are there in plain text.

Thanks! I'll check this out once I find the files.

science

member

Activity: 72

Merit: 10

lucky did u ever look at the link i post before?? there u can find the answer

science

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: FaSan on August 09, 2014, 11:57:17 AM

Quote from: Lucky Cris on August 09, 2014, 11:55:31 AM

Quote from: FaSan on August 09, 2014, 11:52:47 AM

Quote from: Lucky Cris on August 09, 2014, 11:50:56 AM

Quote from: 0xAli on August 09, 2014, 11:58:16 AM

Try this : https://github.com/pilate/keyhunter

FaSan

Excellent! So the output would be the balance and I can just pluck the keys that have balances?

No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.

FaSan

Oh, ok. Forgive me... not much of a techie. But once I get the private keys, then what? Fingers crossed that all of my important wallet.dats are recoverable - aren't the private keys in that file? Guess I'm not sure how to use this script.

Simple start it and wait. After take the list of privatekeys founded and re-import on another wallet. If you lucky, you take back all your bitcoins.

FaSan

Thanks! But I have about 20 different coins... I guess I'll have to try and match which key goes to what wallet?

Lucky Cris

sr. member

Activity: 280

Merit: 250

If you open the wallet.dat in notepad the generic line would be like this:
name"ADDRESS here

Quote from: Lucky Cris on August 09, 2014, 11:45:07 AM

I'm sure I'll have hundreds of wallet.dats, with only one being the one I need.

Is it a vanilla wallet or encrypted?

If it's plain normal wallet.dat then the old wallet can access the new coins. Not sure about encrypted wallets or wallets for tools other than bitcoinQT

Edit:

Other strings in my wallet:
minversion
defaultkey
version
setting
addrIncoming
minversion
defaultkey
version
setting
addrIncoming

I have some not encrypted, but of course my bitcoins are. Are you able to provide a string? Grep's going to pull every document that has those words... that's why I need a string of text.

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: Muhammed Zakir on August 09, 2014, 12:01:12 PM

Try searching anything related to this:

Quote

The original Bitcoin client wallet file is named wallet.dat and contains[1]:

keypairs for each of your addresses
transactions done from/to your addresses
user preferences
default key
reserve keys
accounts
a version number
Key pool
Since 0.3.21: information about the current best chain, to be able to rescan automatically when restoring from a backup.

Kindly,
MZ

Thanks... but I don't even know my addresses.

Newar

legendary

Activity: 1358

Merit: 1001

https://gliph.me/hUF

I looked at an encrypted wallet using medit and the addresses and labels of addresses at least are there in plain text.

science

member

Activity: 72

Merit: 10

have a look here ....

http://blog.cyplo.net/2012/04/01/bitcoin-wallet-recovery-photorec/

science

Muhammed Zakir

hero member

Activity: 560

Merit: 509

I prefer Zakir over Muhammed when mentioning me!

Try searching anything related to this:

Quote

The original Bitcoin client wallet file is named wallet.dat and contains[1]:

keypairs for each of your addresses
transactions done from/to your addresses
user preferences
default key
reserve keys
accounts
a version number
Key pool
Since 0.3.21: information about the current best chain, to be able to rescan automatically when restoring from a backup.

Kindly,
MZ

0xAli

member

Activity: 72

Merit: 10

42

If you open the wallet.dat in notepad the generic line would be like this:
name"ADDRESS here

Quote from: Lucky Cris on August 09, 2014, 11:45:07 AM

I'm sure I'll have hundreds of wallet.dats, with only one being the one I need.

Is it a vanilla wallet or encrypted?

If it's plain normal wallet.dat then the old wallet can access the new coins. Not sure about encrypted wallets or wallets for tools other than bitcoinQT

Edit:

Other strings in my wallet:
minversion
defaultkey
version
setting
addrIncoming
minversion
defaultkey
version
setting
addrIncoming

FaSan

hero member

Activity: 658

Merit: 502

Quote from: Lucky Cris on August 09, 2014, 11:55:31 AM

Quote from: FaSan on August 09, 2014, 11:52:47 AM

Quote from: Lucky Cris on August 09, 2014, 11:50:56 AM

Quote from: FaSan on August 09, 2014, 11:52:47 AM

Try this : https://github.com/pilate/keyhunter

FaSan

Excellent! So the output would be the balance and I can just pluck the keys that have balances?

No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.

FaSan

Oh, ok. Forgive me... not much of a techie. But once I get the private keys, then what? Fingers crossed that all of my important wallet.dats are recoverable - aren't the private keys in that file? Guess I'm not sure how to use this script.

Simple start it and wait. After take the list of privatekeys founded and re-import on another wallet. If you lucky, you take back all your bitcoins.

FaSan

Lucky Cris

sr. member

Activity: 280

Merit: 250

Quote from: Lucky Cris on August 09, 2014, 11:50:56 AM

Quote from: Lucky Cris on August 09, 2014, 11:50:56 AM

Try this : https://github.com/pilate/keyhunter

FaSan

Excellent! So the output would be the balance and I can just pluck the keys that have balances?

No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.

FaSan

Oh, ok. Forgive me... not much of a techie. But once I get the private keys, then what? Fingers crossed that all of my important wallet.dats are recoverable - aren't the private keys in that file? Guess I'm not sure how to use this script.

FaSan

hero member

Activity: 658

Merit: 502

Try this : https://github.com/pilate/keyhunter

FaSan

Excellent! So the output would be the balance and I can just pluck the keys that have balances?

No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.

FaSan

Lucky Cris

sr. member

Activity: 280

Merit: 250