Topic: Lost Savings Wallet Addresses?! (Read 14267 times)
The sad part about this story is that, even though he securely deleted the wallet, we now know that there's most likely still some remnant there that can be recovered with today's wallet recovery technology. Only a full wipe of a drive can permanently destroy a wallet.
Anyone know how to see if the 7208BTC mentioned appears in the block chain at around the date of the original post?
how goes your recovery efforts? Wishing you the best.
I think I just managed to lose a large number of BTC. Here's what happened:
1. I had a wallet with all my BTC. I quit Bitcoin (version 0.3.21) and renamed the entire Bitcoin directory Bitcoin-checking.
2. I re-opened Bitcoin, which created a new Bitcoin directory and downloaded all the blocks again.
3. I copied the address shown, quit Bitcoin, renamed this directory Bitcoin-savings, encrypted it as Bitcoin-savings-encrypted, and saved it in multiple remote locations.
4. I renamed Bitcoin-checking to Bitcoin, then restarted the Bitcoin application.
5. I sent 0.02 BTC to the address from step 3.
6. I quit Bitcoin and renamed the Bitcoin directory to Bitcoin-checking.
7. I unencrypted a copy of Bitcoin-savings-encrypted, renamed the directory to Bitcoin, and restarted the Bitcoin application.
8. My 0.02 BTC showed up in this savings wallet.
9. I copied another address, quit Bitcoin again, renamed the directory as Bitcoin-savings, swapped in Bitcoin-checking and sent lots of BTC to this new savings address.
10. I never updated the Bitcoin-savings-encrypted file after step 3, because I thought the wallet automatically contained 100 pre-generated addresses to start.
11. I securely deleted my unencrypted Bitcoin-savings directory with multiple passes.
12. Later I unencrypted a copy of the Bitcoin-savings-encrypted directory, renamed it Bitcoin, opened the Bitcoin app, and only my original 0.02 BTC are shown even after all the new blocks are downloaded.
So it looks like I lost all the BTC I transferred to my savings wallet! I downloaded bitcointools from here:
https://github.com/gavinandresen/bitcointools
and viewed the contents of my savings wallet.dat from Bitcoin-savings-encrypted with this command:
python dbdump.py --wallet
The output only shows a single PubKey and PrivKey pair (where I sent 0.02 BTC). It also shows two lines that say "Unknown key type: bestblock".
I was under the impression that wallets automatically have 100 pre-generated keys as soon as the wallet is created as mentioned here:
https://en.bitcoin.it/wiki/Securing_your_wallet
So why did my savings wallet that I encrypted in step 3 only have a single address? I clearly completely screwed up by not updating Bitcoin-savings-encrypted after the large transfers, but I thought I only needed to do that after 100 keys had been used for 100 transactions. What went wrong? When does the Bitcoin application actually create those 100 queued keys? Does it only created the pool of pre-generated keys after the first address is actually used?
- Very Sad Puppy
1. I had a wallet with all my BTC. I quit Bitcoin (version 0.3.21) and renamed the entire Bitcoin directory Bitcoin-checking.
2. I re-opened Bitcoin, which created a new Bitcoin directory and downloaded all the blocks again.
3. I copied the address shown, quit Bitcoin, renamed this directory Bitcoin-savings, encrypted it as Bitcoin-savings-encrypted, and saved it in multiple remote locations.
4. I renamed Bitcoin-checking to Bitcoin, then restarted the Bitcoin application.
5. I sent 0.02 BTC to the address from step 3.
6. I quit Bitcoin and renamed the Bitcoin directory to Bitcoin-checking.
7. I unencrypted a copy of Bitcoin-savings-encrypted, renamed the directory to Bitcoin, and restarted the Bitcoin application.
8. My 0.02 BTC showed up in this savings wallet.
9. I copied another address, quit Bitcoin again, renamed the directory as Bitcoin-savings, swapped in Bitcoin-checking and sent lots of BTC to this new savings address.
10. I never updated the Bitcoin-savings-encrypted file after step 3, because I thought the wallet automatically contained 100 pre-generated addresses to start.
11. I securely deleted my unencrypted Bitcoin-savings directory with multiple passes.
12. Later I unencrypted a copy of the Bitcoin-savings-encrypted directory, renamed it Bitcoin, opened the Bitcoin app, and only my original 0.02 BTC are shown even after all the new blocks are downloaded.
So it looks like I lost all the BTC I transferred to my savings wallet! I downloaded bitcointools from here:
https://github.com/gavinandresen/bitcointools
and viewed the contents of my savings wallet.dat from Bitcoin-savings-encrypted with this command:
python dbdump.py --wallet
The output only shows a single PubKey and PrivKey pair (where I sent 0.02 BTC). It also shows two lines that say "Unknown key type: bestblock".
I was under the impression that wallets automatically have 100 pre-generated keys as soon as the wallet is created as mentioned here:
https://en.bitcoin.it/wiki/Securing_your_wallet
So why did my savings wallet that I encrypted in step 3 only have a single address? I clearly completely screwed up by not updating Bitcoin-savings-encrypted after the large transfers, but I thought I only needed to do that after 100 keys had been used for 100 transactions. What went wrong? When does the Bitcoin application actually create those 100 queued keys? Does it only created the pool of pre-generated keys after the first address is actually used?
- Very Sad Puppy
Something else here happended. You don't need more than one address if all you are doing is sending more money to that address. You only need more than one to send money. Did you try to send any money?
Natural Selection. You did not trust in your bitcoins and that's why you deleted your wallet. You do not believe in BTC and that is a problem.
Here i come to save the day
Download this and burn it to a CD
http://www.hirensbootcd.org/download/
when its on the CD make your computer boot from the CD
Stuff will pop on the screen and it will give you an option to boot mini xp, do that
there will be a little symbol in the taskbar in the bottom right right click on it and locate the recovery tools
run whatever one sounds like it would work the best, Restoration 3.2.13 would be my first choice but if that doesnt work or isnt there just try the next one untill you get a good one
You should look in the ~/Library/Application Support/Bitcoin/ folder
Profit like mad if it works and share a small portion of the wealth with me
Download this and burn it to a CD
http://www.hirensbootcd.org/download/
when its on the CD make your computer boot from the CD
Stuff will pop on the screen and it will give you an option to boot mini xp, do that
there will be a little symbol in the taskbar in the bottom right right click on it and locate the recovery tools
run whatever one sounds like it would work the best, Restoration 3.2.13 would be my first choice but if that doesnt work or isnt there just try the next one untill you get a good one
You should look in the ~/Library/Application Support/Bitcoin/ folder
Profit like mad if it works and share a small portion of the wealth with me
Lets do some calculation shall we?
7,208BTC * 30USD/BTC = 216,240USD
Perhaps having the goddamn drive taken open in a clean room isn't that extreme.
I have recovered files before with the program mentioned earlier in the thread, but secure delete screwed that idea over.
It is theoretically possible to recover even overwritten files, though no one has ever demonstrated it being done. But if the German military really could do it, they wouldn't be too keen on publishing a how to on it.
http://en.wikipedia.org/wiki/Data_recovery#Overwritten_data
The possibility of one day recovering that many BitCoins, worth potentially even more later than they are now, would be enough for me to buy a new hard drive and put the old one in a drawer. Even if BitCoins fell to .5USD/BTC it would still be worth way more than a new HD.
7,208BTC * 30USD/BTC = 216,240USD
Perhaps having the goddamn drive taken open in a clean room isn't that extreme.
I have recovered files before with the program mentioned earlier in the thread, but secure delete screwed that idea over.
It is theoretically possible to recover even overwritten files, though no one has ever demonstrated it being done. But if the German military really could do it, they wouldn't be too keen on publishing a how to on it.
http://en.wikipedia.org/wiki/Data_recovery#Overwritten_data
The possibility of one day recovering that many BitCoins, worth potentially even more later than they are now, would be enough for me to buy a new hard drive and put the old one in a drawer. Even if BitCoins fell to .5USD/BTC it would still be worth way more than a new HD.
I can confirm, newly crated wallet shows as having only one key pair with dbdump.py.
I also had a problem where I lost a few bitcoins that were sent to a new address, when restoring the wallet from backup (the difference was the last transaction only).
I also had a problem where I lost a few bitcoins that were sent to a new address, when restoring the wallet from backup (the difference was the last transaction only).
Thanks for confirming. This makes me very depressed. Everything I had read made me believe that 100 pre-generated addresses were created for new wallets.
If I re-open the Bitcoin application with this wallet.dat, wait for it to show my 0.02 BTC transaction, then quit Bitcoin, I can use dbdump.py to see that it now has 100 addresses. However, none of them are the addresses where I transferred all my savings. I guess the pool of 100 addresses isn't created until a transaction is completed. We should update the Wiki to clarify this. I would edit the Wiki myself, but I'm busy contemplating jumping out a window in despair.
Quote
Name: Sad Puppy
Posts: 7 (1 per day)
Respect: 0
Position: Newbie
Date Registered: June 01, 2011, 05:07:17 pm
Last Active: June 02, 2011, 04:15:34 am
Posts: 7 (1 per day)
Respect: 0
Position: Newbie
Date Registered: June 01, 2011, 05:07:17 pm
Last Active: June 02, 2011, 04:15:34 am
Dude, don't give up! Few days ago I thinked that I've lost my wallet, because I saw 0\confirmations on it after, but after several attempts (rescans/ reloading/ ...) i've got my coins back.
First of all make reserve copies of hd.
Then as it already was said -make low level recovering.
I sincerely wish you good luck & not to to lose heart!
Sometimes when your're not in optimistic conditions, your brain gives you bad, but wrong explanations of your issues. Just resist & go on! I think You'll get ALL your savings BACK in several days!
First of all make reserve copies of hd.
Then as it already was said -make low level recovering.
I sincerely wish you good luck & not to to lose heart!
Sometimes when your're not in optimistic conditions, your brain gives you bad, but wrong explanations of your issues. Just resist & go on! I think You'll get ALL your savings BACK in several days!
absolutely try drive recovery. There are some linux tools that recovered a very important file for me. Now, it was a windows file that I had accidentally deleted. I did not securely erase it. But I would absolutely try to recover it.
Jeez fuckin' louise. That's probably up there with accidently running over your own pet. I hope the grief doesn't ruin you.
Hang on to your broken wallet.dat data. Protect it as much as you would if it were not broken. I lost 62 bitcoins in an experiment involving a thumbdrive back in November, but only recently was motivated to attempt to fix it. They can be repaired by the right skillset.
Holy crap, that's horrible! My condolences!
Perhaps next-gen clients should be much more explicit about key management...
Meanwhile, perhaps you'd prefer something tangible and easily modeled like https://github.com/bitcoin-labs/paper-keys
Perhaps next-gen clients should be much more explicit about key management...
Meanwhile, perhaps you'd prefer something tangible and easily modeled like https://github.com/bitcoin-labs/paper-keys
You might try slaving your hard drive to a second computer and using some file recovery software to try to recover the wallet.dat. Of course, I would advise immediately ceasing use of the computer (just powering it off with the power button would be better than shutting down, lest the wallet file be overwritten by some files that are written during shutdown). A decent piece of software might cost $50.
If that doesn't work, there are professional labs that will read the actual data on the disk, if it hasn't already been overwritten. A decent lab would cost $1000 or so. Don't cheap out on this if you try it. I did, and I regret it, a lot.
And beyond that, if you use a mechanical hard drive, forensics labs can actually tell what bits were written to a given sector BEFORE the current bits, because the previous bits leave some sort of magnetic bias behind. That's why military erasing standards dictate that a drive must be overwritten 7 times with random bits before the data that was on it is considered securely erased. I have no idea what it might cost to get a forensics expert to look at your drive though.
If that doesn't work, there are professional labs that will read the actual data on the disk, if it hasn't already been overwritten. A decent lab would cost $1000 or so. Don't cheap out on this if you try it. I did, and I regret it, a lot.
And beyond that, if you use a mechanical hard drive, forensics labs can actually tell what bits were written to a given sector BEFORE the current bits, because the previous bits leave some sort of magnetic bias behind. That's why military erasing standards dictate that a drive must be overwritten 7 times with random bits before the data that was on it is considered securely erased. I have no idea what it might cost to get a forensics expert to look at your drive though.
Unfortunately, I securely deleted the plain text wallet before I realized there was an issue, so it was probably overwritten many times with random bits. I was basically following the steps I found in a thread describing how to create a secure savings wallet.
Even if you can't recover the Private-key for the receiving address, keep both your wallet backups safe and don't give-up and delete them. The BTCs might still be unclaimed by the address that you lost, maybe in the future the network rules will be changed to allow old (1 year, 6 months) unclaimed transactions to be reversed. I really think this should be possible. It will require a change to most of the bitcoin clients on the network before any block containing a "return unclaimed BTCs" transaction will be accepted.
Lookup the sending/receiving address on http://blockexplorer.com/ and find the transaction/block that contains the lost BTCs.
Also I think that new wallets should default to returning change back to the sending address, let people that want anonymous transactions to change to the current method of sending change to a new address.
I feel bad for you dude and hope you can recover it all back......Did you mine these coins or buy them?
Dude make a copy of your whole hard drive with dd command. Maybe there is nonzero chance, that your file was copied somewhere? Maybe the filesystem stored it in two places??
What's the point of doing secure deletion on your own computer anyway?
What's the point of doing secure deletion on your own computer anyway?
I had something similar happen to me. I tried -rescan but it still didn't work. The only way I could get it to work was to delete everything, re-download the blockchain, replace the wallet, then run -rescan.
Good luck getting it back. I'd have a panic attack losing that much!
Good luck getting it back. I'd have a panic attack losing that much!
Doesn't Mac use a journaled file system?
Is journaling for the directory info only, or does it include files? In NTFS, small files AFAIK are just dumped into the directory inline, rather than given their own sectors, which would make them journaled.
Bottom line, it is remotely possible that the journaling functionality may have left that data on your drive in a way you could never "find" it except through a brute force search. Who knows for sure if that's the case. But - you know one key - so a brute force search of the drive to rule it out isn't out of the question.
Although recovery is very voodoo, there is a specific method that could be followed:
0 - if considering it, power off now...don't shut down properly, just grab the electrical cord and pull it out of the wall.
1 - you already know ONE of the keys in this lost wallet.dat, right? Find the bytes comprising the representation of the one known key from the wallet.dat you kept, and then take that hard drive out, use another machine and do a sector-by-sector search for those bytes from another machine. Of course you'll probably bump into the file you kept, but maybe you'll bump into fragments of the deleted file. And if you do, you may never know how it survived.
You don't need recovery of the file, just the few (32?) bytes representing the private key of the address you lost, which might be in the same sector adjacent to the key you have. the wallet can be rebuilt if you know just that number.
If you exported the lost wallet to a text file at any point, then by all means, search for the plaintext of the known key too, where the plaintext of the lost key could be expected adjacent.
This is pie in the sky of course, but if some sector on your drive contains that key, this is also doable without any science fiction.
Is journaling for the directory info only, or does it include files? In NTFS, small files AFAIK are just dumped into the directory inline, rather than given their own sectors, which would make them journaled.
Bottom line, it is remotely possible that the journaling functionality may have left that data on your drive in a way you could never "find" it except through a brute force search. Who knows for sure if that's the case. But - you know one key - so a brute force search of the drive to rule it out isn't out of the question.
Although recovery is very voodoo, there is a specific method that could be followed:
0 - if considering it, power off now...don't shut down properly, just grab the electrical cord and pull it out of the wall.
1 - you already know ONE of the keys in this lost wallet.dat, right? Find the bytes comprising the representation of the one known key from the wallet.dat you kept, and then take that hard drive out, use another machine and do a sector-by-sector search for those bytes from another machine. Of course you'll probably bump into the file you kept, but maybe you'll bump into fragments of the deleted file. And if you do, you may never know how it survived.
You don't need recovery of the file, just the few (32?) bytes representing the private key of the address you lost, which might be in the same sector adjacent to the key you have. the wallet can be rebuilt if you know just that number.
If you exported the lost wallet to a text file at any point, then by all means, search for the plaintext of the known key too, where the plaintext of the lost key could be expected adjacent.
This is pie in the sky of course, but if some sector on your drive contains that key, this is also doable without any science fiction.
You might try slaving your hard drive to a second computer and using some file recovery software to try to recover the wallet.dat. Of course, I would advise immediately ceasing use of the computer (just powering it off with the power button would be better than shutting down, lest the wallet file be overwritten by some files that are written during shutdown). A decent piece of software might cost $50.
If that doesn't work, there are professional labs that will read the actual data on the disk, if it hasn't already been overwritten. A decent lab would cost $1000 or so. Don't cheap out on this if you try it. I did, and I regret it, a lot.
And beyond that, if you use a mechanical hard drive, forensics labs can actually tell what bits were written to a given sector BEFORE the current bits, because the previous bits leave some sort of magnetic bias behind. That's why military erasing standards dictate that a drive must be overwritten 7 times with random bits before the data that was on it is considered securely erased. I have no idea what it might cost to get a forensics expert to look at your drive though.
If that doesn't work, there are professional labs that will read the actual data on the disk, if it hasn't already been overwritten. A decent lab would cost $1000 or so. Don't cheap out on this if you try it. I did, and I regret it, a lot.
And beyond that, if you use a mechanical hard drive, forensics labs can actually tell what bits were written to a given sector BEFORE the current bits, because the previous bits leave some sort of magnetic bias behind. That's why military erasing standards dictate that a drive must be overwritten 7 times with random bits before the data that was on it is considered securely erased. I have no idea what it might cost to get a forensics expert to look at your drive though.
Unfortunately, I securely deleted the plain text wallet before I realized there was an issue, so it was probably overwritten many times with random bits. I was basically following the steps I found in a thread describing how to create a secure savings wallet.
And beyond that, if you use a mechanical hard drive, forensics labs can actually tell what bits were written to a given sector BEFORE the current bits, because the previous bits leave some sort of magnetic bias behind. That's why military erasing standards dictate that a drive must be overwritten 7 times with random bits before the data that was on it is considered securely erased. I have no idea what it might cost to get a forensics expert to look at your drive though.
unfortunately, this is essentially an urban myth. for more information, see the epilogue to gutmann's updated paper on secure erasure from magnetic media. i don't believe there's even one reported case of data recovery after a single pseudorandom pass of overwriting. it would take something like manual scanning using an electron microscope if it were even possible at all. as gutmann wrote:
Quote
with the ever-increasing data density on disk platters and a corresponding reduction in feature size and use of exotic techniques to record data on the medium, it's unlikely that anything can be recovered from any recent drive except perhaps a single level via basic error-cancelling techniques... with modern high-density drives, even if you've got 10KB of sensitive data on a drive and can't erase it with 100% certainty, the chances of an adversary being able to find the erased traces of that 10KB in 200GB of other erased traces are close to zero.
if the data was overwritten by even one pseudorandom pass, it would take well more than the bitcoins' value to recover them. it won't be worth the time and expense.
it is worth walking through the drive with software to see whether you indeed overwrote wallet.dat. some wiping programs don't do what you expect, either because they're poorly written or because the filesystem is more complicated than the case for which they were intended. if that doesn't work, though, you'd do better to assume there's no magical solution in hardware.
Jump to: