I'm working through this page just now.....
https://bitcointalk.org/index.php?topic=34028.520
Topic: Corrupt wallet.dat file. NEED HELP (Read 1115 times)
Using a hex editor to search is explained here.
You could try using a hex editor to do a sector-by-sector search of your hard drive for these bytes
01 03 6B 65 79 41 04
For each occurrence of those bytes you can find there is probably a Bitcoin private key nearby.
This is a hex editor with a suitable search function for a Mac. Its sourceforge files also include Windows and Linux versions.
https://sourceforge.net/projects/wxhexeditor/files/wxHexEditor/v0.23%20Beta/wxHexEditor-v0.23-MacIntel.dmg/download
This quote gives more detailed instructions, and the thread it's from might be worth reading.
You could try using a hex editor to do a sector-by-sector search of your hard drive for these bytes
01 03 6B 65 79 41 04
For each occurrence of those bytes you can find there is probably a Bitcoin private key nearby.
This is a hex editor with a suitable search function for a Mac. Its sourceforge files also include Windows and Linux versions.
https://sourceforge.net/projects/wxhexeditor/files/wxHexEditor/v0.23%20Beta/wxHexEditor-v0.23-MacIntel.dmg/download
This quote gives more detailed instructions, and the thread it's from might be worth reading.
I have been doing some tinkering around, thinking about other people's wallet disasters, and believe I have come to the following conclusion...
If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer. If so, recovery is no longer purely theoretical. With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable.
So here goes...
If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence:
01 03 6B 65 79 41 04...........
the middle four of these bytes represent the string "keyA" in ASCII.
Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later. The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s).
Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex). These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes). If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins! Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find. Carefully search the sectors adjacent to any sector containing the "keyA" sequence above. Then yell for help! (But don't share the private keys in public, unless you want to give away your wallet.)
An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex. In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan. Scanning a full disk can take hours. WinHex must "run as administrator" to be able to scan a physical disk. Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible. Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary.
If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer. If so, recovery is no longer purely theoretical. With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable.
So here goes...
If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence:
01 03 6B 65 79 41 04...........
the middle four of these bytes represent the string "keyA" in ASCII.
Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later. The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s).
Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex). These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes). If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins! Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find. Carefully search the sectors adjacent to any sector containing the "keyA" sequence above. Then yell for help! (But don't share the private keys in public, unless you want to give away your wallet.)
An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex. In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan. Scanning a full disk can take hours. WinHex must "run as administrator" to be able to scan a physical disk. Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible. Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary.
Hello, I'm New to this so apologies if I've posted in the wrong section etc.
I've had the nightmare scenario of loosing all my backups and then discovering the one trace left if an overwritten file on the original hard drive.
The freely available undelete software can locate this file but cannot recover it, and specialist companies don't really sound too enthusiastic that they can help either but will take a look.
I've searched and searched and have found the stuff on pywallet.py but I'm not great at coding and I'd basically say I'm a noon, electrical engineering is my field.
The wallet was made on Bitcoin QT core in 2014 and I'm not sure if I had a paraphrase or not but I'm sure I could cover any possibilities of what it probably is.
I've got hex editor and all the tools needed but I have no idea how to use them.
The system is on windows 10 with the hard drive in question now mounted so it's not the root drive.
Any help on this would be ace, but I'm aware it's already maybe too late
I've had the nightmare scenario of loosing all my backups and then discovering the one trace left if an overwritten file on the original hard drive.
The freely available undelete software can locate this file but cannot recover it, and specialist companies don't really sound too enthusiastic that they can help either but will take a look.
I've searched and searched and have found the stuff on pywallet.py but I'm not great at coding and I'd basically say I'm a noon, electrical engineering is my field.
The wallet was made on Bitcoin QT core in 2014 and I'm not sure if I had a paraphrase or not but I'm sure I could cover any possibilities of what it probably is.
I've got hex editor and all the tools needed but I have no idea how to use them.
The system is on windows 10 with the hard drive in question now mounted so it's not the root drive.
Any help on this would be ace, but I'm aware it's already maybe too late
Jump to: