Topic: How to recover btc after windows reinstall (Read 6680 times)

I don't use whexeditor so I can't suggest a possible solution but pywallet's --recov tool may work.
Follow the steps in this post: https://bitcointalksearch.org/topic/m.60653031
And read the warnings in the next few replies.

For follow-ups, you can start your own topic and provide more info about your situation for better support. (recommended)

Thank you for you quick response. Also my hdd disk image is around 300 Go and when i launch a search using whexeditor it crashes after a few hours do you have any  better software or other way to do this job ?

- Those bytes will only appear on unencrypted "non-descriptor" wallet.dat files, however wallet.dat created by v23.0+ are descriptor by default.
For testing older wallets, create a new wallet but untick "Descriptor Wallet" during wallet creation;
In bitcoin-cli, it's the sixth argument of createwallet command which should be set to false: e.g.: bitcoin-cli createwallet "testwalletname" false false "" false false

- Bitcoin Core doesn't encrypt the whole wallet.
Otherwise, the user will have to provide the passphrase every time he needs to open/load an encrypted wallet.

-snip- i decided to test it on a simple wallet that i created my self using bitcoin core "recent version" and it don't find the "0201010420" when I open it using Hex editor. So I have a few questions ...

1) Does the byte before the private key have changes with the version of bitcoin core that was use to create the wallet.dat ?
2) When you mean encrypted wallet you mean  the wallet as a whole or just the private key ?

Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was.

There is an alternative to using pywallet, but it requires more time and effort.

If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key.

If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address.

https://www.bitaddress.org/

This post explains how to use the webpage.

https://bitcointalksearch.org/topic/m.19522772

This hex editor is capable of searching a whole hard drive.

https[Suspicious link removed]ditor/

These screenshots explain how to open a disk, then search it for the hex string.

Click "devices", then "open disk device", then select the disk letter you want to search.

https://i.imgur.com/p77Eyja.png

Click "edit", then "find".

https://i.imgur.com/IkAmEMY.png

This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive.

https://i.imgur.com/Yufvs5K.png

If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet.

If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions.

http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients

http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients

Electrum should sync almost immediately and give you fast access to your coins.

Don't ever boot from that hard drive again because doing so could wipe all traces of your coins.

Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was.

There is an alternative to using pywallet, but it requires more time and effort.

If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key.

If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address.

https://www.bitaddress.org/

This post explains how to use the webpage.

https://bitcointalksearch.org/topic/m.19522772

This hex editor is capable of searching a whole hard drive.

https://sourceforge.net/projects/wxhexeditor/

These screenshots explain how to open a disk, then search it for the hex string.

Click "devices", then "open disk device", then select the disk letter you want to search.



Click "edit", then "find".



This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive.



If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet.

If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions.

http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients

http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients

Electrum should sync almost immediately and give you fast access to your coins.

Don't ever boot from that hard drive again because doing so could wipe all traces of your coins.

I am paying a professional company to do a raw recovery on my hard drive.  Question what exactly is needed to recover my bitcoins from bitcoin core?  wallet.dat file only?

I am paying a professional company to do a raw recovery on my hard drive.  Question what exactly is needed to recover my bitcoins from bitcoin core?  wallet.dat file only?

It opens a command shell window, do I type ez_setup.py in there? do I leave any spaces and do I press enter?. thanks.

... and did not back up the private passkey.