Pages:
Author

Topic: I need Help finding or recovering bitcoins off an old hard drive - page 3. (Read 2481 times)

legendary
Activity: 1624
Merit: 2481
Would Electrum decrypt these seeds too? is it the same math and hashing...… to get keys from words?

The mnemonic code is not encrypted.
The words are the mnemonic code, which is the seed encoded into a human-readable format.

To answer your question.. no, it is not the same. BIP39 is different from electrums mechanism.
And that's the reason HCP suggested that you check this:

- If ALL 12 words are in the BIP39 wordlist, try a BIP39 compatible wallet (you can also use Electrum for this... and select the "BIP39 Seed" option during seed entry)
- If ALL 12 words are in the old electrum list, try using Electrum (it'll still work with old mnemonics)

Could you do this and report back ?
member
Activity: 180
Merit: 38

Not sure if u didn't get my question or if can't get your answer!!


I think you didn't get my answer.
But i also think that you will get it soon tho  Smiley
member
Activity: 77
Merit: 11
It could be an early Electrum wallet... but I think Electrum was announced late 2011... so it's not likely. Likewise, I think blockchain.info was late in 2011... and I think their early "X word phrases" (which were actually used for password recovery and NOT seed recovery) were like 15 words anyway.

Seed Mnemonics were not that common back then... I mean BIP39 was only created in Sept 2013.

Have you checked the words that you have against this list: https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt
I would also check this old Electrum list: https://github.com/spesmilo/electrum/blob/1.9.8/lib/mnemonic.py

I have not checked the works yet, but thanks for the links.

It's possible that your timeframe is off... so:
 My time frame is sure between 09 and 2011,  but the events are so faded!!

- If ALL 12 words are in the BIP39 wordlist, try a BIP39 compatible wallet (you can also use Electrum for this... and select the "BIP39 Seed" option during seed entry)
- If ALL 12 words are in the old electrum list, try using Electrum (it'll still work with old mnemonics)

So if I download Electrum on a flash drive, then run it on my off line PC I will be able to plug the 12 word seed in, and see if it generates an address, then I can run this address through blockchain.com to see if it is valid, transactions history, and balances.... right??

There may be other, more obscure wallets that were around in that time period... but I can't really think of any off the top of my head... Undecided
Would Electrum decrypt these seeds too? is it the same math and hashing...… to get keys from words?

Thank you,
HCP
legendary
Activity: 2086
Merit: 4361
It could be an early Electrum wallet... but I think Electrum was announced late 2011... so it's not likely. Likewise, I think blockchain.info was late in 2011... and I think their early "X word phrases" (which were actually used for password recovery and NOT seed recovery) were like 15 words anyway.

Seed Mnemonics were not that common back then... I mean BIP39 was only created in Sept 2013.

Have you checked the words that you have against this list: https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt
I would also check this old Electrum list: https://github.com/spesmilo/electrum/blob/1.9.8/lib/mnemonic.py

It's possible that your timeframe is off... so:

- If ALL 12 words are in the BIP39 wordlist, try a BIP39 compatible wallet (you can also use Electrum for this... and select the "BIP39 Seed" option during seed entry)
- If ALL 12 words are in the old electrum list, try using Electrum (it'll still work with old mnemonics)

There may be other, more obscure wallets that were around in that time period... but I can't really think of any off the top of my head... Undecided
member
Activity: 77
Merit: 11
WOW!! hmm, so how can I safely validate that seed I have?? any programs, software/ hardware I can use offline???
What exactly are you attempting to "validate"? Huh Simply that it is a "valid" seed? Or that it generates a known AddressXYZ? Huh
Yes, I'm trying to validate that it's actually a valid seed for a valid wallet that still contains actual coins!
As the previous poster mentioned... running Electrum offline and using the seed there (would probably need to use "Options -> BIP39 seed" on the seed entry screen) is an option. You could also download the "iancoleman" Mnemonic Code Converter and run that offline... it has instructions at the bottom of the page.


Do you know/ remember who had a paper wallet/12 word seed back 10 years ago??
If it is 12 English words... and you're sure that its 10 years ago... then I have no idea... BIP39 was from 2013... Electrum was originally 2011... what is the exact timeframe you are working with? Huh
some where between 2009 to 2011 it's all a fading memory!
HCP
legendary
Activity: 2086
Merit: 4361
WOW!! hmm, so how can I safely validate that seed I have?? any programs, software/ hardware I can use offline???
What exactly are you attempting to "validate"? Huh Simply that it is a "valid" seed? Or that it generates a known AddressXYZ? Huh

As the previous poster mentioned... running Electrum offline and using the seed there (would probably need to use "Options -> BIP39 seed" on the seed entry screen) is an option. You could also download the "iancoleman" Mnemonic Code Converter and run that offline... it has instructions at the bottom of the page.


Do you know/ remember who had a paper wallet/12 word seed back 10 years ago??
If it is 12 English words... and you're sure that its 10 years ago... then I have no idea... BIP39 was from 2013... Electrum was originally 2011... what is the exact timeframe you are working with? Huh
member
Activity: 77
Merit: 11
My question was specifically about working offline on Bitcoin core ( that's where the original wallet was created and I have it already up to date).
Bitcoin Core does not, and never has, used 12 word seeds... if you have a 12 word seed, it was not created with Bitcoin Core.


NOTE: There was a scam clone of Bitcoin Core that supposedly had a "12 word seed recovery phrase" that would be emailed to you when you downloaded/registered for the wallet. If you used this wallet, your coins are basically lost.
Do you know/ remember who had a paper wallet/12 word seed back 10 years ago??
Thank you
member
Activity: 77
Merit: 11
My question was specifically about working offline on Bitcoin core ( that's where the original wallet was created and I have it already up to date).
Bitcoin Core does not, and never has, used 12 word seeds... if you have a 12 word seed, it was not created with Bitcoin Core.


NOTE: There was a scam clone of Bitcoin Core that supposedly had a "12 word seed recovery phrase" that would be emailed to you when you downloaded/registered for the wallet. If you used this wallet, your coins are basically lost.

WOW!! hmm, so how can I safely validate that seed I have?? any programs, software/ hardware I can use offline???
can I create a new wallet on bitcoin core using a seed where it scans through the block chain to match it??
HCP
legendary
Activity: 2086
Merit: 4361
My question was specifically about working offline on Bitcoin core ( that's where the original wallet was created and I have it already up to date).
Bitcoin Core does not, and never has, used 12 word seeds... if you have a 12 word seed, it was not created with Bitcoin Core.


NOTE: There was a scam clone of Bitcoin Core that supposedly had a "12 word seed recovery phrase" that would be emailed to you when you downloaded/registered for the wallet. If you used this wallet, your coins are basically lost.
member
Activity: 77
Merit: 11
Not sure if u didn't get my question or if can't get your answer!!

My question was specifically about working offline on Bitcoin core ( that's where the original wallet was created and I have it already up to date).

Don't know much about Electrum but I though Electrum is an online only server!!

My understanding also is some/ not all hardware wallets can automatically regenerate private/ public keys ( basically restore your wallet) if you input into them the 12 words seed ( as a recovery).
member
Activity: 180
Merit: 38

Any way some one can recover or regenerate (keys/ coins/ wallet) using a 12 word seed through an updated bitcoin core while offline?
or do u need a hardware wallet to do so?

in other words what's the best way to do an offline (keys/ coins/ wallet) recovery using a 12 word seed??

Thank you,

Import the seed into [offline] electrum and grab the wif + address.

Alternatively you can download some page and open it offline https://iancoleman.io/bip39/
member
Activity: 77
Merit: 11

Any way some one can recover or regenerate (keys/ coins/ wallet) using a 12 word seed through an updated bitcoin core while offline?
or do u need a hardware wallet to do so?

in other words what's the best way to do an offline (keys/ coins/ wallet) recovery using a 12 word seed??

Thank you,
HCP
legendary
Activity: 2086
Merit: 4361
does PYwallet extract a potential wallet.dat file from the hard drive? (Thus altering the data on the original hard drive) or does it simply copy( duplicate the wallet.dat file data)? (leaving the original hard drive as it was before the scan)
It simply reads and copies the data... it doesn't move any data from the original drive. So, using a clone should yield the same results as working from the original devices (assuming the clone is in fact an exact 1:1 copy)


How do I check if the partial recovered/ recovered Pywallet is a valid wallet? If it said no key found do I still check it and how?? ( is there a simple easy way)??
Any wallet.dat file created by PyWallet should theoretically be a "valid" wallet file... it might be empty and contain no keys, but the file itself should still valid. If it said "no keys" found, then it probably won't have any keys... you can verify by using the PyWallet --dumpwallet command.
member
Activity: 77
Merit: 11
Personally I recommend you create an image of the drive before you start playing around as you might overwrite sensitive data
and have it as a backup.

Recovery attempts should never be done on the original drive.

From a forensic point of view, one should create 2 images (raw copies) and perform recovery on one of them.
Then after trying out a specific tool, a new raw copy should be created to try further recovery software on it.


One backup should always be kept safe and the original drive should never be touched with recovery software.


These are the basics of forensics.


"Laboratory techniques" of recovery trust solely the plates of original drive . The heads of any HDD are not perfectly positioned when the plates are spinning. so, in fact, the separate  track consists of thousands of "micro-tracks" tiny shifted from each other and the lab methods take an advantage of that, trying to use the best preserved "micro-tracks".

so u r saying that working off an exact bit by bit (sector by sector) clone is not as accurate? and will not properly search all files?
u still didn't answer my question!

does PYwallet extract a potential wallet.dat file from the hard drive? (Thus altering the data on the original hard drive) or does it simply copy( duplicate the wallet.dat file data)? (leaving the original hard drive as it was before the scan)
member
Activity: 77
Merit: 11
Does Pywallet copy the wallet.dat file from old drives or does it extract the whole file where I can’t find it if I rescan The same drive again??

How do I check if the partial recovered/ recovered Pywallet is a valid wallet? If it said no key found do I still check it and how?? ( is there a simple easy way)??
Thank you,
legendary
Activity: 2268
Merit: 1092
For the OP in this thread i would advise him to scan the drive in read only mode with testdisk and i am convinced that if it's still there, it will show the wallet as a deleted file with the ability to restore and save it to some other location given the one fact that the sectors have not been overwritten.

An application that looks for specific wallet signatures would be a better idea, since it doesn't care whether metadata (such as folder and filename information) still exists. A wallet file which cannot be undeleted by standard utilities may still have recoverable fragments littered over the drive. Looks like pywallet performs such a function.
member
Activity: 180
Merit: 38
About helping the OP , do you think it helps to advise him to start deleting things ?
At what point did anyone in this thread advise the OP to delete anything? Huh

OP was advised that they could simply open the file with a text editor (or spreadsheet) and see what was in it... but any Transaction export from Bitcoin Core would not contain any private keys and would be of very little value in coin/wallet recovery (at best, you'd get a list of addresses that you could view on a block explorer to see if they held any coins)

My bad i got these threads mixed up.

For the OP in this thread i would advise him to scan the drive in read only mode with testdisk and i am convinced that if it's still there, it will show the wallet as a deleted file with the ability to restore and save it to some other location given the one fact that the sectors have not been overwritten.

I see a lot of people advise these windows based recovery applications of which many need to be purchased and this is totally unnecessary.

You can download a free Linux live dvd and use that to boot up the computer to then mount the drive read only, then make a backup, and then start analyzing every last bit that is on that drive.

Download the ISO and either burn it to a dvd, or burn it to a USB stick using Unetbootin.
Then boot up the machine in copy to ram mode and start the terminator shell.
Then simply type testdisk and select the drive and scan it.

If unsure don't do anything and especially do not mess with the other settings so only use the analyzer function and leave the rest because if you make one mistake things will get worse.
HCP
legendary
Activity: 2086
Merit: 4361
About helping the OP , do you think it helps to advise him to start deleting things ?
At what point did anyone in this thread advise the OP to delete anything? Huh

OP was advised that they could simply open the file with a text editor (or spreadsheet) and see what was in it... but any Transaction export from Bitcoin Core would not contain any private keys and would be of very little value in coin/wallet recovery (at best, you'd get a list of addresses that you could view on a block explorer to see if they held any coins)
member
Activity: 180
Merit: 38

If you never assume anything and do stuff without making any assumptions, you will never succeed in anything.


I also know from experience that this statement is not true.
I succeeded in many things, because i worked with what i had in stead of making assumptions.
Logic is simple it's either true or false.
There is no room for assumptions.

About helping the OP , do you think it helps to advise him to start deleting things ?
legendary
Activity: 1624
Merit: 2481
I know from experience that when dealing with older data, you can never assume anything, you have to do analysis without making any assumptions.
[...]
The right approach is to analyze everything, regardless of what the customer claims.

If you never assume anything and do stuff without making any assumptions, you will never succeed in anything.

It is publicly known how wallets worked in the past and how they work now.
And a CSV export of transaction data does not contain any sensitive information (i.e. private keys). So it is pointless.

You are free to "not assume anything" and waste your time, but it won't help OP.
Pages:
Jump to: