Pages:
Author

Topic: How to recover btc after windows reinstall - page 5. (Read 6634 times)

legendary
Activity: 2772
Merit: 2846
Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was.

There is an alternative to using pywallet, but it requires more time and effort.

If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key.

If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address.

https://www.bitaddress.org/

This post explains how to use the webpage.

https://bitcointalksearch.org/topic/m.19522772

This hex editor is capable of searching a whole hard drive.

https://sourceforge.net/projects/wxhexeditor/

These screenshots explain how to open a disk, then search it for the hex string.

Click "devices", then "open disk device", then select the disk letter you want to search.



Click "edit", then "find".



This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive.



If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet.

If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions.

http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients

http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients

Electrum should sync almost immediately and give you fast access to your coins.

Don't ever boot from that hard drive again because doing so could wipe all traces of your coins.
sr. member
Activity: 336
Merit: 252
32 Bitcoin is not nothing so I'd rather spent a 100$ to get it done porfessionally and ultimately get 84K rather than messing with it myself. I advise you to not mess a lot with it man. Get it done professionally and hopefully you can enjoy your treasure Cheesy
legendary
Activity: 2772
Merit: 2846
There are instructions for setting pywallet up in this post. However the post was made in 2015 and I don't know if all the download links for the dependencies work any more.

https://bitcointalksearch.org/topic/m.13238007

Also achow101 says the wallet.dat format changed, and pywallet struggles to work on the new format. I can't say what format your wallet.dat would be because I think the change of format was in 2013 when you say your brother installed his Bitcoin software.

The Bitcoin Core wallet structure has changed since pywallet was last updated so pywallet will not work very well with new wallets.

I suggest that you use Bitcoin Core's dumpwallet console command to get all of your private keys instead of a 3rd party tool.
member
Activity: 149
Merit: 22
🔴🔵 FoxMixer.com 🔵🔴
Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks.

You could search in the app data dir of the user that was logged in.
Alternatively, if you have a second hdd you could restore all the discovered files of recuva to that second hdd and scan for your wallet within these files afterwards. It's probably the better way as the more you do on your current hdd, the more likely it is that you overwrite your wallet permanently.
HCP
legendary
Activity: 2086
Merit: 4314
Generally, most wallet files will encrypt the private keys... and they'll be stored in possibly binary or hex format. Attempting to identify them simply by scanning bytes on the harddrive is going to be like looking for a needle in a stack of needles. Undecided

full member
Activity: 217
Merit: 109
Will a private key show as a 51 character string starting with 5, or will it be in another form?, when searching the hdd. Thanks.
full member
Activity: 217
Merit: 109
Which wallet were you using?
Nobody has asked this, so I think I should.

Was it Core? pywallet only works with Core wallets.
If not, there's still a chance, maybe you can contact a bitcoin recovery service.
I know that the wallet was installed i think in 2013 so assuming it is core?. Thanks.
Hmm you have 32 BTC and you do not know the wallet you used  Huh Anyway whatever software you use to try to recover remember to recover files on different drive it is really important .
Like i said it is not my wallet or balls up, and my brother in law has given up on rescuing the bitcoins. So what would you do if you were handed the laptop?.
full member
Activity: 217
Merit: 109
Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many?
No offense, but if this is the level of questions you're asking while searching to recover $84k, I'd say STOP IT NOW and hire a professional data recovery service.
Fair comment, but if i can find the info i need then i would rather try myself and avoid possibly being ripped off. Thanks.
full member
Activity: 217
Merit: 109
Are public keys 33 characters long and private keys 51 characters long always?. Thanks.
legendary
Activity: 3290
Merit: 16489
Thick-Skinned Gang Leader and Golden Feather 2021
Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many?
No offense, but if this is the level of questions you're asking while searching to recover $84k, I'd say STOP IT NOW and hire a professional data recovery service.
sr. member
Activity: 840
Merit: 266
Which wallet were you using?
Nobody has asked this, so I think I should.

Was it Core? pywallet only works with Core wallets.
If not, there's still a chance, maybe you can contact a bitcoin recovery service.
I know that the wallet was installed i think in 2013 so assuming it is core?. Thanks.
Hmm you have 32 BTC and you do not know the wallet you used  Huh Anyway whatever software you use to recover remember to recover files on different drive it is really important .
full member
Activity: 217
Merit: 109
Which wallet were you using?
Nobody has asked this, so I think I should.

Was it Core? pywallet only works with Core wallets.
If not, there's still a chance, maybe you can contact a bitcoin recovery service.
I know that the wallet was installed i think in 2013 so assuming it is core?. Thanks.
full member
Activity: 217
Merit: 109
Would i see private keys in wallet import format assuming i find any private keys on the drive, and are they always the same length of characters?. thanks again.
legendary
Activity: 2954
Merit: 4158
So what would the exact file address be Users\Username\Apps\Roaming\Bitcoin\??, any help welcome.
Also, what would a private key typically look like compared with a public key. Thanks.
A private key typically starts with a L, K or 5 for wallet import format.

It doesn't really matter. You are going to need look for file name that is wallet.dat or anything that ends with .dat. The wallet.dat is not in a human readable format so you likely cannot use that to search for it.
full member
Activity: 217
Merit: 109
Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks.
You should search the place where your data directory is stored at. By default, it is at %appdata%/Bitcoin.

If you changed the data directory, you have to specify it.
So what would the exact file address be Users\Username\Apps\Roaming\Bitcoin\??, any help welcome. Also, what would a private key typically look like compared with a public key. Thanks.
full member
Activity: 158
Merit: 113
Which wallet were you using?
Nobody has asked this, so I think I should.

Was it Core? pywallet only works with Core wallets.
If not, there's still a chance, maybe you can contact a bitcoin recovery service.
legendary
Activity: 2954
Merit: 4158
Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks.
You should search the place where your data directory is stored at. By default, it is at %appdata%/Bitcoin.

If you changed the data directory, you have to specify it.
full member
Activity: 217
Merit: 109
Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks.
full member
Activity: 217
Merit: 109
Can anyone point me to a guide on using pywallet or a recovery program to attempt getting my btc back from a hard drive that has had windows reinstalled. The drive was removed from the laptop and was used for less than a week after the stupid event. I have bought a hard drive caddy but want to know if i should use a recovery program or can i just use pywallet?. If anyone could point me to a guide that is useable by a computer novice, ie a step by step spoon feed type guide, i would be very grateful. Cheers guys.

--

If you have the HDD, I would recommend one piece of software that I have used before(Though not recover DBase Files, that is the kind of file for wallet.dat), here the link: http://www.cgsecurity.org/wiki/TestDisk_Download

The software you want to use is PhotoRec. I would give it a shot. Just remember to save the recovered files in another drive, not the one you are scanning. Good Luck!
Thanks everyone, will keep trying with whatever info i can find or is suggested by anyone else. cheers.
Pages:
Jump to: