https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091
I need a guide for the noob. Can someone please explain in detail., my knowledge is not enough. Please..
Topic: I lose my wallet ! Help and Rewards (Read 563 times)
Thanks for your reply. I tried a new wallet.dat file and managed to find it but no keys were found.
Is that test wallet.dat file created by Bitcoin Core v23.0 while "descriptor wallet" is ticked?Because if it's a descriptor wallet, there may be an incompatibility with the way how pywallet or other prvKey recovery tools search for deleted keys.
It's just a test anyway so, it's not a big issue,
but if you still want to try if pywallet --recover is working, create a non-descriptor wallet instead by unchecking all checkbox when creating a test wallet.dat file.
I find the strings 0201010420 many times in my own wallet, but I can't find "3081D30201010420". Hex codes in my wallet continue as follows ''0201010420 D030.....47'' . I converted most of the hex codes but no result. I tried many recovery programs Recuva, Minitool, EaseUs, Diskdrill, Photorec. I think the name of the file has changed and overwritten, but the hard disk was not used much after the files were deleted.
I wanted to try keyhunter and https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091 but couldn't find enough information. Now i downloaded the demo version of r-studio and did a deep scan, I'm looking at the hex codes of all the files found and it's taking too long.
Thanks for your reply. I tried a new wallet.dat file and managed to find it but no keys were found.
Is that test wallet.dat file created by Bitcoin Core v23.0 while "descriptor wallet" is ticked?Because if it's a descriptor wallet, there may be an incompatibility with the way how pywallet or other prvKey recovery tools search for deleted keys.
It's just a test anyway so, it's not a big issue,
but if you still want to try if pywallet --recover is working, create a non-descriptor wallet instead by unchecking all checkbox when creating a test wallet.dat file.
-snip-
Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ?should i use a different python script ? or code?
but in my recent tests (just yesterday after my previous post) it failed to do so; IDK, maybe because the wallet.dat was just saved in my test drive's cache.
Anyways, you should try another tool, specially the one suggested by others above.
Thanks for your reply. I tried a new wallet.dat file and managed to find it but no keys were found.i am trying hex codes now.wallet.dat wasn't encrypted, that's what I remember.I will report the results.
-snip-
Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ?should i use a different python script ? or code?
but in my recent tests (just yesterday after my previous post) it failed to do so; IDK, maybe because the wallet.dat was just saved in my test drive's cache.
Anyways, you should try another tool, specially the one suggested by others above.
Hi when you find the 01010420 you count 64 characters after it and you will get your private key. I would copy it down. Then you take that and convert it to Wif number. Youll need to find a converter to get Wif format.
If it works you can send me a reward also. If you need help ask.
Yes i am trying hex codes, but there are too many. If it works you can send me a reward also. If you need help ask.
Hi when you find the 01010420 you count 64 characters after it and you will get your private key. I would copy it down. Then you take that and convert it to Wif number. Youll need to find a converter to get Wif format.
If it works you can send me a reward also. If you need help ask.
If it works you can send me a reward also. If you need help ask.
-snip-
and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'
I do not know what to do.
I cannot find any reference on the code pointing to that specific error aside from the full message in my previous post which is benign.and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'
I do not know what to do.
Did it asked for the to-be-created "recovered-walelt.dat"?
Did it asked for possible passphrases after that?
if so, pywallet did its job and didn't found anything from the --recov_device.
For reference, it'll output something like this if it found nothing:
Code:
0.00 Go read
...
n.nn Go read
Read n Go in n minutes
Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..
...
n.nn Go read
Read n Go in n minutes
Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..
Otherwise, it'll output something like this is it found possible wallets and/or keys but with '0' result:
Code:
...
Found n possible wallets
Found n possible encrypted keys
Found n possible unencrypted keys
...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key
Found n possible wallets
Found n possible encrypted keys
Found n possible unencrypted keys
...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key
Does it look like the former?
or the latter where it shows possible wallets/keys but output's nothing to the recovered wallet.dat?
Because for the former, it means that there's no wallet.dat found in the disk.
For the latter, it's either the passphrase is incorrect or you've provided a passphrase for unencrypted keys.
I remember my balance in bitcoin-qt file, I even remember the day I deleted it.
When I search with hex editor, I can find the result ''0201010420'' and much more.
but in pywallet scan I find this result :
Code:
0.00 Go read
...
n.nn Go read
Read n Go in n minutes
Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..
...
n.nn Go read
Read n Go in n minutes
Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..
Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ?
should i use a different python script ? or code?
Is there another program with ''0201010420'' hex codes?
-snip-
and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'
I do not know what to do.
I cannot find any reference on the code pointing to that specific error aside from the full message in my previous post which is benign.and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'
I do not know what to do.
Did it asked for the to-be-created "recovered-walelt.dat"?
Did it asked for possible passphrases after that?
if so, pywallet did its job and didn't found anything from the --recov_device.
For reference, it'll output something like this if it found nothing:
Code:
0.00 Go read
...
n.nn Go read
Read n Go in n minutes
Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..
...
n.nn Go read
Read n Go in n minutes
Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..
Otherwise, it'll output something like this is it found possible wallets and/or keys but with '0' result:
Code:
...
Found n possible wallets
Found n possible encrypted keys
Found n possible unencrypted keys
...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key
Found n possible wallets
Found n possible encrypted keys
Found n possible unencrypted keys
...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key
Does it look like the former?
or the latter where it shows possible wallets/keys but output's nothing to the recovered wallet.dat?
Because for the former, it means that there's no wallet.dat found in the disk.
For the latter, it's either the passphrase is incorrect or you've provided a passphrase for unencrypted keys.
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code :
-snip-
Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
The complete message should be "WARNING:root:pycrypto or libssl not found, decryption may be slow".-snip-
Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
It should still work but slower, did it end with another error?
But I see that you're recovering from C: drive which is the system drive and also set a folder in that drive as the output folder of pywallet.
That not recommended since the data that you want to recover may get overwritten by pywallet's output itself or your OS's page files, not to mention the files that you've downloaded/written to the disk.
I wrote this code like this :
Code:
C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device G: --recov_size=465Gio --recov_outputdir C:\2
and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'
I do not know what to do.
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code :
-snip-
Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
The complete message should be "WARNING:root:pycrypto or libssl not found, decryption may be slow".-snip-
Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
It should still work but slower, did it end with another error?
But I see that you're recovering from C: drive which is the system drive and also set a folder in that drive as the output folder of pywallet.
That not recommended since the data that you want to recover may get overwritten by pywallet's output itself or your OS's page files, not to mention the files that you've downloaded/written to the disk.
I used several file recovery programs but i couldn't find the wallet.dat file. Could the name of the file have changed?
I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ??
I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ).
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code :
Code:
C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device C: --recov_size=465Gio --recov_outputdir C:\Users\Hoss\Desktop\found_wallet
Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
old hdd : IDE
windows 8.1
python 2.7
now i am trying to convert all hex codes and try, and waiting your help.
I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ??
I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ).
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code :
Code:
C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device C: --recov_size=465Gio --recov_outputdir C:\Users\Hoss\Desktop\found_wallet
Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
old hdd : IDE
windows 8.1
python 2.7
now i am trying to convert all hex codes and try, and waiting your help.
So long as the wallet was unencrypted and the data still exists this tool will recover it https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091 and can be pointed at a raw disk image.
I saw that tool some time ago. But since it's created 11 years ago for 32-bit linux OS, i have doubt it will run on modern linux OS (with exception Debian for i386/x86 architecture). Do you have experience running/using it in past few years?
The folder includes a 64-bit binary.
Code:
$ hostnamectl
[...]
Kernel: Linux 5.14.21-150400.24.18-default
Architecture: x86-64
[...]
[...]
Kernel: Linux 5.14.21-150400.24.18-default
Architecture: x86-64
[...]
Thanks for the confirmation. I just tried it on Debian 64-bit VM and it works without any problem. On a side note, i archived it at https://web.archive.org/web/20220826092610/https://www.makomk.com/~aidan/wallet-recover-0.3-linux.tar.gz in case the website is permanently gone.
So long as the wallet was unencrypted and the data still exists this tool will recover it https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091 and can be pointed at a raw disk image.
I saw that tool some time ago. But since it's created 11 years ago for 32-bit linux OS, i have doubt it will run on modern linux OS (with exception Debian for i386/x86 architecture). Do you have experience running/using it in past few years?
The folder includes a 64-bit binary.
Code:
$ hostnamectl
[...]
Kernel: Linux 5.14.21-150400.24.18-default
Architecture: x86-64
[...]
[...]
Kernel: Linux 5.14.21-150400.24.18-default
Architecture: x86-64
[...]
So long as the wallet was unencrypted and the data still exists this tool will recover it https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091 and can be pointed at a raw disk image.
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)
I'd suggest you to bring your HDD to expert due to these reasons,
1. When you use CCleaner to delete file, it does more than marking the file as deleted. AFAIK by default it perform simple overwrite.
2. Some software to convert RAW to NTFS could cause data loss.
There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
Why do you think it's not overwritten when recovery program can't even find the file?
For the broken HDD I'd look for professionals. On the other on I'd look for wallet files and private keys (see pywallet app for searching).
Afaik there is also one trusted person on the forum who can do this (I guess that somebody will post his username), but you have to be very careful and cross-check the info since scammers too may come and pretend to try to help you.
So you mined bitcoin for several years without knowing what it is and in the end deleting the files 
Sounds strange but looking at the value of bitcoin it could be possible that it is wort to give the drives to a professional data recovery company assuming you know all your passwords.
Sounds strange but looking at the value of bitcoin it could be possible that it is wort to give the drives to a professional data recovery company assuming you know all your passwords. 
Look up whatever latest software forensic professionals are using.
That is most likely a generic recovery program that tries to recover all files. However, OP is only interested in Berkeley DB version 4 files. So you'd need specific software that scans every single unallocated sector in the disk's filesystem (and this is significantly easier to do for Linux filesystems than Windows NTFS and FAT32, because of the openness of the filesystem source code) and scan for anything that looks like a table, ckey, mkey and such.
But if the wallet file is encrypted, I'm not sure what is to be gained from doing this - you only need the mkey, since it generates all the other private keys and morever, it is used to encrypt all those ckeys - the password is not used for that purpose.
I can help i think.Use pywallet you can find deleted private keys from storage.
I was able to find some of my private keys thanks to this software.
If you need help, don't hesitate to post and i'll explain it all here.
I was able to find some of my private keys thanks to this software.
If you need help, don't hesitate to post and i'll explain it all here.
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)
There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
I waiting for your ideas and suggestions.
There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
I waiting for your ideas and suggestions.
Look up whatever latest software forensic professionals are using. I know Recuva but that is very casual, you would need the best in the game, probably external tools and hardware. Avoid all of these dodgy "give me your HDD and we will give you back your coins".
Also are you sure you used NTFS format? try FAT32. It was still used back then. Always backup the data before doing format conversions.
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)
Are you sure you had bitcoins back in 2012?
What format have you been able to recover files in so far? Have the recovery programmes managed to recover any files from your system (extensions might be handy here to see if any dat files have already been recovered)?
There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
That sounds like it's been overwritten or you're not using good recovery software.
Have you searched the drive for wallet.dat if it's working properly - and just left that search running?
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)
There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
I waiting for your ideas and suggestions.
I used several file recovery programs but i couldn't find the wallet.dat file. Could the name of the file have changed?
I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ??
I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ).
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code :
Code:
Gives a fault : ''pycrypto or lib ssl not found''
when it asks for possible passwords i can't type anything just enter key works
where is the problem??
old hdd : IDE
windows 8.1
python 2.7
now i am trying to convert all hex codes and try, and waiting your help.
There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
I waiting for your ideas and suggestions.
I used several file recovery programs but i couldn't find the wallet.dat file. Could the name of the file have changed?
I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ??
I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ).
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code :
Code:
Code:
C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device G: --recov_size=465Gio --recov_outputdir C:\2
Gives a fault : ''pycrypto or lib ssl not found''
when it asks for possible passwords i can't type anything just enter key works
where is the problem??
old hdd : IDE
windows 8.1
python 2.7
now i am trying to convert all hex codes and try, and waiting your help.
Jump to: