Lost coins in stupid way | Bitcointalksearch.org

yilacay565

brand new

Activity: 0

Merit: 0

philipma1957

legendary

Activity: 4256

Merit: 8551

'The right to privacy matters'

I pointed a rental at solo.ckpool

@ op

maybe you get lucky and I hit a block.

https://solo.ckpool.org/users/146UJM5kgzLVUV23CXCf33KQKHckoX1gx3

pawanjain

hero member

Activity: 2702

Merit: 716

Nothing lasts forever

Quote from: xmr9 on October 21, 2020, 06:21:52 PM

Guys, I have try many of the method, but no luck, the biggest trouble is encrypted disk. all recovery programs is not working perfect with encrypted ssd. I have try to read disk sector by sector, but what I see that there are no old my file copy, so my summuary that when I have saved my txt file it was overwritten in the same sector. I am trying other methods like in CSI

I will inform if some of them will work. I am decrypted my ssd copy and try to recover with all the paid/free programs, but they are not working good what I can see from the result. So i have got one software for criminalistic copy of the SSD disk, the process is very slowly, I will inform if it work for me and I will share news with community.

I have try this method also:

https://www.linuxquestions.org/questions/linux-general-1/how-to-recover-overwritten-file-774712/

OP you should try to give more information on your post like which text editor you were using, which wallet does the seed belongs to, do you have the wallet.dat with you etc..
These things would enlighten us more and will help to recover your funds quickly.

If you have the wallet installed on your system then you can simply export a new seed from it.
If you don't have the wallet in your system then this means you either manually typed the seed in a text file on your system or copied it through an external storage.
If you used an external storage to copy the seed then you can try to use recovery software on the external storage to recover the earlier version of text file.
If you copied from within your system then try to find if there are any clipboard recovery software.

philipma1957

legendary

Activity: 4256

Merit: 8551

'The right to privacy matters'

@ op you fucked up. It happens. I still have 2 eth coins in a frozen wallet that I have not been able to recover.

I have an idea I will post it in about 10 -20 minutes.

Iced

full member

Activity: 635

Merit: 208

Belgian based crypto-enthusiast

Did you try Autopsy?

https://github.com/sleuthkit/autopsy/releases

bob123

legendary

Activity: 1624

Merit: 2481

Quote from: NotATether on October 31, 2020, 05:33:49 AM

EaseUS only works on Windows and MacOS, not Linux Mint. I don’t think OP is in a position to take out his internal hard drive and attach it to a Windows computer to use that software and he said his disk is encrypted anyway so it will be impossible to read.

And OP shouldn't do that, even if he could.
Windows is not able to read other file systems properly.

For forensic tasks, you should always use a linux-based distro. Especially if the OS from which you are trying to recover is a linux distro (i.e. linux file systems).

Quote from: NotATether on October 31, 2020, 05:33:49 AM

And if the OS is rebooted then the RAM is also zeroed IIRC (or maybe that’s only when power is disconnected).

When rebooting, there usually is a short period of time where the RAM is not powered.

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: Kakmakr on October 30, 2020, 08:01:40 AM

Quote from: MrFreeDragon on October 22, 2020, 05:02:11 AM

If you open and use the file before deleting it could store in the physical memory. So, I hope you already made a dump of your RAM.
The easy way to do it is to use rekall tool (http://www.rekall-forensic.com/):

~snip

Now the dump of your RAM is stored in forensic_RAM_image.raw file.

To me ... I think it is already too late for that... it sounds as if he already rebooted the Operating System.. so whatever was stored in the RAM at the time, would be lost.

It also sounds as if he overwritten the previous txt file with new data... so he might have to find some forensic software that would be able to restore previous copies of the same text file and just hope that the same sector on the hard drive was not used to write the new txt file. Roll Eyes

Have you tried, "EaseUS Data Recovery" software?

EaseUS only works on Windows and MacOS, not Linux Mint. I don’t think OP is in a position to take out his internal hard drive and attach it to a Windows computer to use that software and he said his disk is encrypted anyway so it will be impossible to read.

@MrFreeDragon dumping the RAM is a good first step but there is several other data we need to get before the seed can be searched for, like which address was the text editor program loaded at, where was its program data memory address, we also need to know which text editor OP was using so we can see where and how many blocks of memory are allocated for the text buffer, their sizes, and to get that info the source code needs to be inspected.

So for example if the text editor stores the whole file in a single large string buffer then chances are the seed phrase was overwritten if it was the first line of the file and that was deleted. But if it’s using some other data structure (highly probable if it has an undo/redo button) then the seed could be at some node whose memory was freed.

All of this becomes less possible to get as more time passes since the text editor was closed, because the RAM gets overwritten with other stuff. And if the OS is rebooted then the RAM is also zeroed IIRC (or maybe that’s only when power is disconnected).

Kakmakr

legendary

Activity: 3542

Merit: 1965

Leading Crypto Sports Betting & Casino Platform

Quote from: MrFreeDragon on October 22, 2020, 05:02:11 AM

If you open and use the file before deleting it could store in the physical memory. So, I hope you already made a dump of your RAM.
The easy way to do it is to use rekall tool (http://www.rekall-forensic.com/):

Code:

$ cd rekall/tools/linux/
$ make

$ sudo insmod pmem.ko

$ sudo lsmod

$ dd if=/dev/pmem of=forensic_RAM_image.raw

$ rmmod pmem

Now the dump of your RAM is stored in forensic_RAM_image.raw file.

To me ... I think it is already too late for that... it sounds as if he already rebooted the Operating System.. so whatever was stored in the RAM at the time, would be lost.

It also sounds as if he overwritten the previous txt file with new data... so he might have to find some forensic software that would be able to restore previous copies of the same text file and just hope that the same sector on the hard drive was not used to write the new txt file. Roll Eyes

Have you tried, "EaseUS Data Recovery" software?

MrFreeDragon

sr. member

Activity: 443

Merit: 350

If you open and use the file before deleting it could store in the physical memory. So, I hope you already made a dump of your RAM.
The easy way to do it is to use rekall tool (http://www.rekall-forensic.com/):

Code:

$ cd rekall/tools/linux/
$ make

$ sudo insmod pmem.ko

$ sudo lsmod

$ dd if=/dev/pmem of=forensic_RAM_image.raw

$ rmmod pmem

Now the dump of your RAM is stored in forensic_RAM_image.raw file.

xmr9

newbie

Activity: 2

Merit: 9

Guys, I have try many of the method, but no luck, the biggest trouble is encrypted disk. all recovery programs is not working perfect with encrypted ssd. I have try to read disk sector by sector, but what I see that there are no old my file copy, so my summuary that when I have saved my txt file it was overwritten in the same sector. I am trying other methods like in CSI

I will inform if some of them will work. I am decrypted my ssd copy and try to recover with all the paid/free programs, but they are not working good what I can see from the result. So i have got one software for criminalistic copy of the SSD disk, the process is very slowly, I will inform if it work for me and I will share news with community.

I have try this method also:

https://www.linuxquestions.org/questions/linux-general-1/how-to-recover-overwritten-file-774712/

bob123

legendary

Activity: 1624

Merit: 2481

Any updates? Any progress?
Did you already shutdown your PC or is it still running?

Overwriting a file does usually not immediately mean the old one is inaccessible anymore. But since this was 3 days ago, i guess you gave up on it already?

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

Quote from: NotATether on October 17, 2020, 11:28:33 AM

I’d go further and suggest that people designate an old device they don’t use anymore as storage for their old wallets and files and keep it disconnected from the internet.

Everyone should do this as standard. You can buy external storage for about 25 bucks per terabyte. There is no excuse to not having all your important files and documents regularly backed up.

Quote from: NotATether on October 17, 2020, 11:28:33 AM

A lot of people are sloppy with their file management and forget where they put their backups, as well as other various important files on their main computer, which is just as bad as losing them.

There is little point in backing up the files on the same piece of hardware as the original files are stored. The only thing that protects you against is if you accidentally delete them or overwrite them. It does not protect against theft, loss, hardware failure or damage, natural disaster, etc.

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: o_e_l_e_o on October 17, 2020, 10:53:22 AM

Moving forward, I would suggest to anyone reading this thread that you never destroy your only copy of a wallet, private key, seed phrase, back up, or whatever. There is no telling when you might make a mistake like OP has, or someone sends you coins to an old address, or you need to sign a message from an old address to prove ownership, or a dozen other possible scenarios. There is no good reason to delete a wallet.

I’d go further and suggest that people designate an old device they don’t use anymore as storage for their old wallets and files and keep it disconnected from the internet. A lot of people are sloppy with their file management and forget where they put their backups, as well as other various important files on their main computer, which is just as bad as losing them. I’d go further and keep them all in the same folder like the desktop or documents folder.

If you don’t have an old computer then use an old Android and transfer the files with Bluetooth instead. I suspect that with the short lifespan of phones, most people have at least one they don’t use anymore.

o_e_l_e_o

legendary

Activity: 2268

Merit: 18711

If you are unable to recover the file yourself, there are a number of file recovery services which exist. All of them cost money, and all of them are a huge privacy and security risk as they involving handing over your hard drive (or at least, the clone of your hard drive you should have made) to complete strangers. Only you will know if 0.95 BTC is worth the financial cost and the security and privacy invasion to you personally.

Moving forward, I would suggest to anyone reading this thread that you never destroy your only copy of a wallet, private key, seed phrase, back up, or whatever. There is no telling when you might make a mistake like OP has, or someone sends you coins to an old address, or you need to sign a message from an old address to prove ownership, or a dozen other possible scenarios. There is no good reason to delete a wallet.

Quote from: satoshi on October 03, 2010, 03:54:07 PM

Sigh... why delete a wallet instead of moving it aside and keeping the old copy just in case? You should never delete a wallet.

nc50lc

legendary

Activity: 2534

Merit: 6080

Self-proclaimed Genius

Quote from: xmr9 on October 15, 2020, 08:12:09 AM

-snip-
I have checked both of seeds and found that one wallet is empty.
I don't know how, but I have deleted seed of 0.95BTC and stored empty wallet seed. I have not shut down my pc, but I have saved my txt file.

In what way did you found out that the other one has a balance?
Have you restored it through a Bitcoin wallet at some point and deleted the wallets??

Willitivity

sr. member

Activity: 1190

Merit: 256

Sorry about your lost. Don't be too hard on yourself as nobody is above mistakes but that was a really costly one. Anyway, I used linux mint first before trying out other distros and from to time, I make mistakes such as this but was able to get the deleted files back using these steps:

1) If it's not on your Desktop, you can put it there: Menu > System Settings > Desktop > change the Trash setting from Off to On.

Or, if you don't like icons on your desktop,

2) Menu > Files > Go > Trash. Opens the Trash folder and check for the .txt file

mocacinno

legendary

Activity: 3584

Merit: 5243

https://merel.mobi => buy facemasks with BTC/LTC

Quote from: cryptoworld99 on October 16, 2020, 06:26:36 AM

Have you tried rolling back your linux OS environment $ apt-get -s install $(apt-history rollback | tr '\n' ' ') i can't promise that it will work but it's worth a shot.

this command rolls back packages after an upgrade. This won't help the OP. He deleted the wrong line from a text file and re-saved it afterwards, rolling back upgraded packages won't fix this i'm afraid.

cryptoworld99

member

Activity: 84

Merit: 22

Have you tried rolling back your linux OS environment $ apt-get -s install $(apt-history rollback | tr '\n' ' ') i can't promise that it will work but it's worth a shot.

Chikito

legendary

Activity: 2366

Merit: 2054

Have you try PhotoRec or r-linux?, before using that software you should try to boot use live cd Linux to decrypting your SSD disk first. or It might be a good way if you running it all in Live cd.

BitMaxz

legendary

Activity: 3374

Merit: 3095

Playbet.io - Crypto Casino and Sportsbook

Can you try this method below.

- https://gist.github.com/bonyiii/1471379

I don't know if it will work on the encrypted disk you can try it but if it doesn't work you might need to find a way first to decrypt your SSD before this method will work.

Or try this script below.

- https://gist.github.com/jas-/adf4d4fbdea7d6436d40

Just modify it a little bit if which file you are trying to recover. I don't know if these old methods will work "nothing will be lose if you just try"

Topic: Lost coins in stupid way (Read 527 times)