Around 5 months ago, my friend received 65BTC
http://blockchain.info/fb/1hg6a4 for services rendered. Recently he approached me to help him get his bitcoins because his btcoin-qt client kept crashing everytime he tried to open the application. I figured it would be about a two minute fix to run a rescan/resynchronize to to clean up a minor corruption.
After taking his wallet.dat I noticed the only address associated with it was 18nPHGz1B4Hrww7wn5qwj8we6s9WL1hL74, not the address he received payment on. I tried to gather the timeline of events as best I could to figure out where he even got 1HG6A4fCnVEKR25T9GgVxH9vVyTv5eLn87. From what i can recreate, at some point in time, he opened his bitcoin-qt client and copy and pasted his address that was displayed and sometime shortly after bitcoin-qt crashed and never could be reopened. Fastfoward to where we are today.
I assumed somehow his wallet.dat was deleted, overwritten, or something. He's on a 60G @ /dev/disk0 mac book air, solid state, but since it has been 5 months since the transaction, the chances of recovering this private key seems very slim.
I attempted to recover using pywallet, and it wasn't to recover any full wallets, but it did leave a recovered_wallet.dat with some data, but when looking at the hex nothing seems relevant to a private key. (from what i gathered i should be looking for)
I also tried using photorec with no success.
I have not tried
https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091 because i wasn't sure how to build the binary for a mac os machine.
Is it time to give up?