Need help and advice regarding recovery

ph1980

newbie

Activity: 9

Merit: 7

Quote from: NotATether on July 07, 2022, 02:02:59 AM

Quote from: HCP on July 06, 2022, 08:36:55 PM

Honestly, I don't really fancy your chances... an XP machine that was reformatted to Win7 and then "used" for up to 2 years afterwards? Undecided

Particularly if the friend nearly filled up the hard disk with data, or maybe even half of the hard disk. In those cases, the wallet bytes won't even be on the raw image, and you'd have to use some specialized tools to see if you can read the original (unencrypted) bytes.

It was pretty clean not many files, it was used mainly for work accounts/ quotation after formatting but i don't think the existance of any wallet.dat remains - i found and recovered a few long lost photos from the xp data and thats about it. Time to move on, the btc will just have to remain where its been since 09.

Really like to say thanks to everyone who took time to give me some advice and tips to help. cheers

ph1980

newbie

Activity: 9

Merit: 7

Quote from: HCP on July 06, 2022, 08:36:55 PM

Honestly, I don't really fancy your chances... an XP machine that was reformatted to Win7 and then "used" for up to 2 years afterwards? Undecided

Also... that browser based version of PyWallet isn't really suitable for disk/image scanning for wallet files... it was more as a utility for working directly with known wallet.dat files.

If you're trying to scan the disk/image for possible files... you'll need to use the command line version.

Late replying back to this thread, been away with temp illness.

Yeah think you're right tbh. Chances look dead. The PC was used about this long after reformatting before the motherboard/cpu or whatever failed and i never bothered with it again.

BatuhanZ

newbie

Activity: 6

Merit: 0

Quote from: BitMaxz on July 07, 2022, 10:20:06 AM

Quote from: BatuhanZ on July 07, 2022, 07:57:47 AM

this is true. Absolutely I agree... Trusting is important. I need information so I can help. How will I get this information ?
I think private scanning software with python for this or try another method, i need check i need look , i need test more test ? How ? He will come my house ? How is it going to be. That is the law of this universe.

I want help but this is very hard progress in here ...

Best Regards.

Why don't you just guide him instead?

For me, you don't need to check and look and test the owner can able to do this and tell you what it looks like and the information you need if it isn't risky then the owner can share it publicly here except for important data it shouldn't be shared here or to you.

About how then why? Why would he come to your house? Unless you are trusted he can able to go there but if not, that's risky.

25 year experience. im 45 years old. Developing software is easy. It is difficult to detect.
You are right too. I will write what to do.

Step 1 : You need detect fat system for sector scannig. Fat12/16/32 bla bla. If ntfs its hard Sad

because it has an authorization system. Found !!! the file does not mean accessing it.
Step 2 : How long it was used after format. Fat system is changed ? Which sectors were rebuilt ? or Which sectors were owerwrite ?
Step 3 : Is there a partition ? if yes you remember partition location for your data ? If your data on second or third partition your chances are higher.
Step 4 : After the determinations are made, the appropriate tool or software should be found and the audit should be started.

You dont know python or c++ i recomended "Deep Scan" tools from Easeus Software for you. Dont forget you need sector based scan. Not partition or not another.
if you want help write here please

BitMaxz

legendary

Activity: 3304

Merit: 3037

BTC price road to $80k

Quote from: BatuhanZ on July 07, 2022, 07:57:47 AM

this is true. Absolutely I agree... Trusting is important. I need information so I can help. How will I get this information ?
I think private scanning software with python for this or try another method, i need check i need look , i need test more test ? How ? He will come my house ? How is it going to be. That is the law of this universe.

I want help but this is very hard progress in here ...

Best Regards.

Why don't you just guide him instead?

For me, you don't need to check and look and test the owner can able to do this and tell you what it looks like and the information you need if it isn't risky then the owner can share it publicly here except for important data it shouldn't be shared here or to you.

About how then why? Why would he come to your house? Unless you are trusted he can able to go there but if not, that's risky.

BatuhanZ

newbie

Activity: 6

Merit: 0

Quote from: NeuroticFish on July 07, 2022, 04:09:51 AM

Quote from: BatuhanZ on July 07, 2022, 02:54:14 AM

if you want private help pm or reply me.

I will not say OP should avoid this kind of offers, but I will say to be extremely cautious, since in most cases this kind of offers can easily lead to stolen data and stolen money.
Especially newbie accounts have nothing to lose (reputation doesn't matter for them).

@BatuhanZ, why don't you try to help him publicly if your intentions are good?

this is true. Absolutely I agree... Trusting is important. I need information so I can help. How will I get this information ?
I think private scanning software with python for this or try another method, i need check i need look , i need test more test ? How ? He will come my house ? How is it going to be. That is the law of this universe.

I want help but this is very hard progress in here ...

Best Regards.

NeuroticFish

legendary

Activity: 3668

Merit: 6382

Looking for campaign manager? Contact icopress!

Quote from: BatuhanZ on July 07, 2022, 02:54:14 AM

if you want private help pm or reply me.

I will not say OP should avoid this kind of offers, but I will say to be extremely cautious, since in most cases this kind of offers can easily lead to stolen data and stolen money.
Especially newbie accounts have nothing to lose (reputation doesn't matter for them).

@BatuhanZ, why don't you try to help him publicly if your intentions are good?

BatuhanZ

newbie

Activity: 6

Merit: 0

It's not the formatting that matters. how long was it used after format ?
I am a software developer since 2001. I have recovered such data and wallet before. But every case is different.
if you want private help pm or reply me.

I hope you find it. Good luck

NotATether

legendary

Activity: 1568

Merit: 6660

bitcoincleanup.com / bitmixlist.org

Quote from: HCP on July 06, 2022, 08:36:55 PM

Honestly, I don't really fancy your chances... an XP machine that was reformatted to Win7 and then "used" for up to 2 years afterwards? Undecided

Particularly if the friend nearly filled up the hard disk with data, or maybe even half of the hard disk. In those cases, the wallet bytes won't even be on the raw image, and you'd have to use some specialized tools to see if you can read the original (unencrypted) bytes.

HCP

legendary

Activity: 2086

Merit: 4314

Honestly, I don't really fancy your chances... an XP machine that was reformatted to Win7 and then "used" for up to 2 years afterwards? Undecided

Also... that browser based version of PyWallet isn't really suitable for disk/image scanning for wallet files... it was more as a utility for working directly with known wallet.dat files.

If you're trying to scan the disk/image for possible files... you'll need to use the command line version.

ph1980

newbie

Activity: 9

Merit: 7

Quote from: ABCbits on July 02, 2022, 08:25:06 AM

Quote from: ph1980 on July 01, 2022, 10:08:34 AM

Quote from: ?? on ??

Just wondering, where did you download pywallet? AFAIK there's no option to install pywallet.

i found it through this old thread, 10 posts down.

https://bitcointalksearch.org/topic/pywallet-install-help-2398504

I understand what you meant. To be precise, it extract all files and install required software (such as Python). I just tried "PWI_0.0.3.exe" on Windows 10, but i encountered problem and it quit hallway. But i managed to run pywallet on Windows (after i check install script and other user post). Here's what i did,

1. Download and install Python from https://www.python.org/downloads/release/python-2716/. I choose "Windows x86-64 MSI installer". Make sure you enable "Add python.exe" to the path.

https://i.ibb.co/ZmcRQfh/b.png

2. Download pywallet from https://raw.githubusercontent.com/jackjack-jj/pywallet/b52c955f8c93a75745166ebf281448016e1f22e2/pywallet.py. I right clicked the page and save it at Desktop. On your Desktop, you should see "pywallet.dat" file.
3. Open CMD and run this

Code:

cd Desktop
pip install twisted
python pywallet.py --web --port 8989

4. Open your browser and enter localhost:8989. Afterwards you should see something like this.

https://i.ibb.co/mzXxK79/a.png

P.S. Sorry for rough explanation, i rarely use windows for this kind of stuff. I also never use web version either.

Thanks a lot for this guide, very good. I will have a crack at it this week. I will also go back to Linux and try as suggested - making a clone using DD and try to work it that way. It is all beyond me this stuff, bit too technical but willing to try and at least put any doubts to rest by exhausting every avenue of search. All i know is at the time i was running SETI (search for extra terrestrial intelligence) - crunching data & i ran bitcoin to mine in the background alternatively, it was in 2009 as i left the country later that year. If it's gone it's gone, game over. Appreciate all the replies

Cheers

ABCbits

legendary

Activity: 2870

Merit: 7490

Crypto Swap Exchange

Quote from: ph1980 on July 01, 2022, 10:08:34 AM

Quote from: ?? on ??

Just wondering, where did you download pywallet? AFAIK there's no option to install pywallet.

i found it through this old thread, 10 posts down.

https://bitcointalksearch.org/topic/pywallet-install-help-2398504

I understand what you meant. To be precise, it extract all files and install required software (such as Python). I just tried "PWI_0.0.3.exe" on Windows 10, but i encountered problem and it quit hallway. But i managed to run pywallet on Windows (after i check install script and other user post). Here's what i did,

1. Download and install Python from https://www.python.org/downloads/release/python-2716/. I choose "Windows x86-64 MSI installer". Make sure you enable "Add python.exe" to the path.

2. Download pywallet from https://raw.githubusercontent.com/jackjack-jj/pywallet/b52c955f8c93a75745166ebf281448016e1f22e2/pywallet.py. I right clicked the page and save it at Desktop. On your Desktop, you should see "pywallet.dat" file.
3. Open CMD and run this

Code:

cd Desktop
pip install twisted
python pywallet.py --web --port 8989

4. Open your browser and enter localhost:8989. Afterwards you should see something like this.

P.S. Sorry for rough explanation, i rarely use windows for this kind of stuff. I also never use web version either.

ph1980

newbie

Activity: 9

Merit: 7

Quote from: ?? on ??

Quote from: ph1980 on July 01, 2022, 06:24:00 AM

I've tried to run pywallet but really struggling.

I downloaded the file into downloads it auto ran the installation

Just wondering, where did you download pywallet? AFAIK there's no option to install pywallet.

Quote from: ph1980 on July 01, 2022, 06:24:00 AM

Opened win + R CMD

Typed cd C:\Users\'name'\downloads\ pywallet

it comes back to say
The system cannot find the path specified.

At least for this error, it's likely you write the folder name incorrectly. Have you tried cd one folder at a time?

Code:

cd Downloads
cd pywallet

i found it through this old thread, 10 posts down.

https://bitcointalksearch.org/topic/pywallet-install-help-2398504

ph1980

newbie

Activity: 9

Merit: 7

Quote from: ph1980 on June 30, 2022, 07:30:38 AM

Not tried pywallet.....I installed python 2.7 on my c drive . How do i run it , just command line ? and say if the mounted disk is Local disk (z) how do i get it to target that cloned image ?

If you launch it from inside of WSL, you will have your drives under /mnt folder, like "/mnt/c/...."(it will be probably "--recov_device /mnt/z")
If you boot your machine into pure linux, it will appear somewhere under /dev/ folder.

[/quote]

I've tried to run pywallet but really struggling.

I downloaded the file into downloads it auto ran the installation - created files in c: program files 86x\ GnuWin32 folder it also created a pywallet bat file which it dumped into downloads where the auto zip file was. Ran the install bat.

Opened win + R CMD

Typed cd C:\Users\'name'\downloads\ pywallet

it comes back to say
The system cannot find the path specified.

This is melting my mind Grin

ph1980

newbie

Activity: 9

Merit: 7

I've got Winhex downloaded and i did a search the other day for 0420 and it came back with results but i read this is common to find. I didnt know about the other hex to search like the ones you've added , so i will try them.

I used ddrescue to create a disk image of the hdd on Linux. i think i will look at your suggestion. Simply because i'm not sure if the Windows software is including everything. I ran Testdisk, Dmde, recuva and r-studio and they all find different deleted files, quite impressive really but i need to search for the wallet - need to get those python scripts working..I'm literally looking through folders one by one.

I did find bitminter client and username details to which i contacted their email support - its no longer running. Was good enough to reply to inform me it was just dust, i dont even remember running it so sounds right.😁

cheers for everyones input.

PawGo

legendary

Activity: 952

Merit: 1367

Quote from: jackg on June 30, 2022, 11:46:06 AM

Also I don't think bitcoin core had encryption back in 2009 so you could attempt to search to your disk for strings of data the wallet file would have saved (but I've not seen an example of one from that long ago so I'm not sure how they would have been).

Some say it should be (hex value):

Code:

fd1701308201130201010420

or shorter version, for example:

Code:

201010420

Then the next bytes should be your private key.

About making copy: did you consider using linux tool 'dd' to make disk image? It seems it would copy all.

If you may read in the same language as Molière (or just want to use google translate), take a look there:
https://www.radjaidjah.org/index.php?post/2014/09/07/Sauver-ses-bitcoins-de-la-corruption

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: ph1980 on June 30, 2022, 07:54:57 AM

If i figure out pywallet and it comes back with nothing then maybe best put it to bed and accept it's gone.

You could just give up and come back to it if it's not fun or you can't be bothered doing it. Once you've got a disk image, your files are safe and can be recovered later on anyway if you get motivation to come back to it/get bored.

I don't know how useful this is but you might want to look at installing software like autopsy which should be able to sort things in a time wise format (from a disk image) - presumably your wallet.dat file could then be found by looking at things of a similar timeframe (but I'm not sure on how the filesystem in XP worked).

Also I don't think bitcoin core had encryption back in 2009 so you could attempt to search to your disk for strings of data the wallet file would have saved (but I've not seen an example of one from that long ago so I'm not sure how they would have been).

ph1980

newbie

Activity: 9

Merit: 7

Ok thanks guys, i will look into WSL that sounds a lot better to figure out. Yes i was wondering which cloning software will pick up all deleted data and not worry about missing sections. As i say, some software has picked up deleted data, it's just messy to look at so i'm not too sure. If i figure out pywallet and it comes back with nothing then maybe best put it to bed and accept it's gone.

NeuroticFish

legendary

Activity: 3668

Merit: 6382

Looking for campaign manager? Contact icopress!

I am inexperienced on recovering your wallet, however, some basics:

1. WSL is a tool you install on Windows 10, tool which allows you run a Linux (you have to install from Microsoft Store) like you'd run any other Windows application (or console application).
2. I may be wrong, but cloning has a pretty good chance to completely miss the clusters marked as deleted or, even more, from a previous partitioning or formatting. Keep this in mind.
3. I think that best would be to get a HDD or SSD (different from the disk you have the valuable data on, but I guess that you already know you should not write absolutely anything onto the valuable disk) you install Linux onto it and run everything under pure Linux (no WSL) and then work on reading all the clusters of the other disk (I don't know with which tool) and scan them for useful data. The valuable HDD will probably stay either as USB disk, either as a secondary HDD.

PawGo

legendary

Activity: 952

Merit: 1367

Quote from: ph1980 on June 30, 2022, 07:30:38 AM

Hi, Yes i am running Windows 10. What is WSL , is it like a dual boot thing ?

No, it is rather "subsystem", which you just launch like any other program.
https://docs.microsoft.com/en-us/windows/wsl/install
Or just download Ubuntu or Debian from the Store.

Quote from: ph1980 on June 30, 2022, 07:30:38 AM

Not tried pywallet.....I installed python 2.7 on my c drive . How do i run it , just command line ? and say if the mounted disk is Local disk (z) how do i get it to target that cloned image ?

If you launch it from inside of WSL, you will have your drives under /mnt folder, like "/mnt/c/...."(it will be probably "--recov_device /mnt/z")
If you boot your machine into pure linux, it will appear somewhere under /dev/ folder.

ph1980

newbie

Activity: 9

Merit: 7

Quote from: PawGo on June 30, 2022, 07:21:52 AM

Quote from: ph1980 on June 30, 2022, 05:58:49 AM

Then as i read was advisable , i cloned the HDD booting my windows laptop into a Linux ubuntu usb boot key.

Depending on your Windows version (10?) You may use WSL, to have easily "two" systems, and launch linux as a any other program. Maybe it would make your life a little easier. Then you may see your mounted/external disk in WSL and use linux tools.
Were you able to restore any folders structure? What you see are probably program file, not saved wallet.
Did you try pywallet or not yet?
https://bitcointalksearch.org/topic/guide-recover-your-deleted-keys-38004

Hi, Yes i am running Windows 10. What is WSL , is it like a dual boot thing ? No i have not restored any folder structures, i ran Testdisk, r-studio - which came back with deleted sections but i didn't recover them as was unsure what to bother with. Also ran DMDE using the search for wallet.ini, but as you say likely program file.

Not tried pywallet.....I installed python 2.7 on my c drive . How do i run it , just command line ? and say if the mounted disk is Local disk (z) how do i get it to target that cloned image ?

Cheers

Topic: Need help and advice regarding recovery (Read 313 times)