Topic: Found my old wallet.dat which seems to be corrupted. Please Help. - page 2. (Read 488 times)

I used the bitcoin-wallet command:

bitcoin-wallet -wallet=mywallet salvage

No errors, but still corrupted.

Hi, thanks for the response.

1- I have created a sector to sector clone of the hard drive using an app called HDDRawcopy and I am working the recovery on the cloned drive.

2- The tool I outlined above was the only one that managed to find something. I used Recuva and Rstudio so far, and several other recovery software that managed to recover no files at all.

3- I ran the pywallet script but it does not generate any new wallet files, nor does it give any errors in the CMD prompt.

I will attempt another scan with Rstudio using a custom extension XML I found online that targets specifically BTC wallets. I am also considering running the search and recovery option in Pywallet. Besides this, I am stuck for now and do not know if I can find someone trustworthy enough to work on the recovery.

If there is anything you recommend I do please let me know.

Size is fitting for new wallet.dat files which contains descriptors.
It can go as low as 12kB if unused and a few more kilobytes after deriving more addresses or after receiving transactions.

Did bitcoin-wallet salvage command returned with an error?
Also, -salvagewallet was a Bitcoin Core command line option, are you using an old version?

1. Are you working on the disk or have you made an image of the drive to search through?

2. There's a chance the file you've recovered isn't the only copy of your wallet, there's a chance it is (especially if it's the only wallet.dat file you could possibly recover) but there's a chance the file was moved after being created (by the operating system) so there might be another copy on the drive.

3. If it can't be salvaged by bitcoin core, have you tried other wallet recovery software like pywallet (available from github). There's probably a few different types of software you can run it though faster than searching for identifiers/separators.

I've been scouring through my old hard drives to find an old wallet containing some BTC I purchased many years ago, 8-10 years ago approximately. Most were formatted and some were damaged.

After 2 months and searching through 7 old drives, I finally managed to recover what looks like a wallet.dat file using the method outlined in this old thread below. I would have done this years ago if I knew deleted data is possible to recover. But I am not very technical.

https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091

Note, I tried several different ways to search for the wallet, and that is the only method that managed to recover something.

Here are the challenges I am facing and need your help to understand if recovery will be possible.

1- This particular hard drive unfortunately was formatted at some point. I have no idea what else it might have gone through, but the recovery tool posted by @makomk managed to recover 1 key, and it generated a .dat file with it.
2- Loading the wallet.dat into Bitcoin Core gives me a corrupt wallet error. Using the -salvagewallet command in bitcoin-wallet.exe did not work.
3- The wallet size is concerning, it is only 16KB. The -salvagewallet tool doubled the file's size for some reason. And after some googleing, I found that wallets are typically 100KB and up.
4- Opening the recovered wallet with a Hex editor I can find some clues that this is possibly the wallet I am looking for. I found sequence 0201010420, but its followed by zeros. Also found the sequence 03 6b 65 79 41 and KeyA, which is also followed by zeros. According to this detailed French guide https://www.radjaidjah.org/index.php?post/2014/09/07/Sauver-ses-bitcoins-de-la-corruption these are relevant to a BTC wallet. I'm not technical or knowledgeable enough to know whether these sequences are related to something else or not, and this could be something other than my lost wallet.
 
With all the above in mind, a few questions come to mind.

1- Could this be a partially recovered wallet since the sequences mentioned above are all followed by zeros, file size is too small, and the hex file is generally empty?
2- The wallet is possibly encrypted and hex editor will not reveal any keys?
3- Has the wallet file been partially overwritten?
4- Are there any other methods I can use to rescan and extract the wallet file?

 Any help would be greatly appreciated.