Topic: How to recover btc after windows reinstall - page 5. (Read 6692 times)

Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was.

There is an alternative to using pywallet, but it requires more time and effort.

If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key.

If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address.

https://www.bitaddress.org/

This post explains how to use the webpage.

https://bitcointalksearch.org/topic/m.19522772

This hex editor is capable of searching a whole hard drive.

https://sourceforge.net/projects/wxhexeditor/

These screenshots explain how to open a disk, then search it for the hex string.

Click "devices", then "open disk device", then select the disk letter you want to search.



Click "edit", then "find".



This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive.



If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet.

If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions.

http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients

http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients

Electrum should sync almost immediately and give you fast access to your coins.

Don't ever boot from that hard drive again because doing so could wipe all traces of your coins.

32 Bitcoin is not nothing so I'd rather spent a 100$ to get it done porfessionally and ultimately get 84K rather than messing with it myself. I advise you to not mess a lot with it man. Get it done professionally and hopefully you can enjoy your treasure

There are instructions for setting pywallet up in this post. However the post was made in 2015 and I don't know if all the download links for the dependencies work any more.

https://bitcointalksearch.org/topic/m.13238007

Also achow101 says the wallet.dat format changed, and pywallet struggles to work on the new format. I can't say what format your wallet.dat would be because I think the change of format was in 2013 when you say your brother installed his Bitcoin software.

You could search in the app data dir of the user that was logged in.
Alternatively, if you have a second hdd you could restore all the discovered files of recuva to that second hdd and scan for your wallet within these files afterwards. It's probably the better way as the more you do on your current hdd, the more likely it is that you overwrite your wallet permanently.

Generally, most wallet files will encrypt the private keys... and they'll be stored in possibly binary or hex format. Attempting to identify them simply by scanning bytes on the harddrive is going to be like looking for a needle in a stack of needles.

Will a private key show as a 51 character string starting with 5, or will it be in another form?, when searching the hdd. Thanks.

try
https://www.easeus.com/partition-recovery/

Like i said it is not my wallet or balls up, and my brother in law has given up on rescuing the bitcoins. So what would you do if you were handed the laptop?.

Fair comment, but if i can find the info i need then i would rather try myself and avoid possibly being ripped off. Thanks.

Are public keys 33 characters long and private keys 51 characters long always?. Thanks.

No offense, but if this is the level of questions you're asking while searching to recover $84k, I'd say STOP IT NOW and hire a professional data recovery service.

Hmm you have 32 BTC and you do not know the wallet you used   Anyway whatever software you use to recover remember to recover files on different drive it is really important .

I know that the wallet was installed i think in 2013 so assuming it is core?. Thanks.

Would i see private keys in wallet import format assuming i find any private keys on the drive, and are they always the same length of characters?. thanks again.

A private key typically starts with a L, K or 5 for wallet import format.

It doesn't really matter. You are going to need look for file name that is wallet.dat or anything that ends with .dat. The wallet.dat is not in a human readable format so you likely cannot use that to search for it.

So what would the exact file address be Users\Username\Apps\Roaming\Bitcoin\??, any help welcome. Also, what would a private key typically look like compared with a public key. Thanks.

Which wallet were you using?
Nobody has asked this, so I think I should.

Was it Core? pywallet only works with Core wallets.
If not, there's still a chance, maybe you can contact a bitcoin recovery service.

You should search the place where your data directory is stored at. By default, it is at %appdata%/Bitcoin.

If you changed the data directory, you have to specify it.

Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks.

Thanks everyone, will keep trying with whatever info i can find or is suggested by anyone else. cheers.