Topic: Old wallet.dat from 2011 (Read 379 times)

Indeed... It's possible that the "old" keys are buried in amongst the "bc1" keys etc... without an address for reference it is a little bit difficult to suggest a search term though.

If there are no keys showing a legacy address, then it's possible that this wallet.dat is actually not the wallet.dat that your friend thinks it is. For instance, depending on how your friend setup and ran Bitcoin Core, it may have created a completely new (empty) wallet.dat on first startup and populated the keypool etc... and your friend has simply mixed up the newly created .dat with their old .dat file.

The other thing that concerns me is that it has an xpriv (Master Private Key)... which means it is an "HD" wallet built from a seed... from memory, Bitcoin Core does not automatically convert a "non-HD" wallet into an "HD" wallet... you need to explicitly use the -upgradewallet command or the upgradewallet RPC command in 0.21.0.

He emailed the wallet.dat to himself, I'm going to have him fw me the original email, as I'm assuming he did something with it before he sent it to me.

This wallet already appears to have been loaded into Bitcoin Core previously... in Mid-December 2020... and it has "refilled" the keypool with a bunch of new private keys/addresses. The 0014 privkeys and "3" addresses are the P2SH versions of the private keys.

What exactly has your "friend" done with this wallet.dat before they gave it to you? How was it "recovered" to start with?

Thanks, if I get anything from this, you'll def get a piece....

Do you know what the keys that start with 0014 represent? The pub key for those start with 3's, also what is the reason they are showing up in that format? bc1 and 3, in 2011 there were only legacy addresses correct?

Also: what does 2020-12-17T16:32:01Z reserve=1 mean? Not sure where that date comes from in Kxxxxxxxxxxxxxxxxxxxxxxx 2020-12-17T16:32:01Z reserve=1 # addr=bc1xxxxxxxxxxxxxxxxxxxxxxxx does that mean it was overwritten on that date?

If you were able to load the wallet in Bitcoin Core and run dumpwallet then all you need are the privkeys starting with "5" or "L" or "K". You can import all of those into an Electrum wallet (https://electrum.org/#download - Read the HOWTO verify guide here: https://bitcointalksearch.org/topic/m.54223763)


As I said, it seems that you're having issues with PyWallet due to the updates... you'd either need to switch back to Python2.7 and my old version of PyWallet... or wait for JackJack to get a less "unstable" version of the new Python3 compatible Pywallet up and running.

But it's not necessary if the wallet.dat opens in Bitcoin Core... you'd just be dumping the same info... so I'd just forget about PyWallet for now.

Focus on importing those private keys into another wallet, and check to see if any transaction history is found (and hopefully a positive balance! )

So I was able to open the wallet.dat file in the latest version of Bitcoin Core, when I do dumpwallet "~/wallet.txt" the file has a bunch of pub/priv keys in it. For example it has a line that says extended "private masterkey: xprivxxxxxxxxxxxxxxxxxxxxx" followed by 2,000 priv keys that begin with '5' or 'L' and the public keys beginning with 'bc1'. After those 2,000 pub/priv key pairs there are another 2,000 pub/priv keys pairs, priv keys that begin with '00' and pub keys that begin with '3'.

Example: Kxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 2020-12-17T16:32:01Z reserve=1 # addr=bcxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx hdkeypath=m/0'/0'/696'

00xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 0 script=1 # addr=3xxxxxxxxxxxxxxxxxxxxxxxxxxx

any ideas?

Update on pywallet: Still couldn't get it to dumpwallet, stuck on this error:

Wallet data not recognized: Bdict({'__key__': b'\bunch of stuff like \x03\x11\xab ', '__value__': b'UNKNOWN_DATA', '__type__': b''})
Wallet data not recognized: Bdict({'__key__': b'\bunch of stuff like \x03\x11\xab', '__value__': b'UNKNOWN_DATA', '__type__': b''})
Wallet data not recognized: Bdict({'__key__': b'\'bunch of stuff like \x03\x11\xab, '__value__': b'UNKNOWN_DATA', '__type__': b''})
Traceback (most recent call last):
  File "pywallet.py", line 2316, in parse_wallet
    item_callback(type, d)
  File "pywallet.py", line 2716, in item_callback
    json_db[type] = 'unsupported'
  File "pywallet.py", line 111, in __setitem__
    return super(Bdict, self).__setitem__(bytes_to_str(k), v)
  File "pywallet.py", line 90, in bytes_to_str
    return k.decode()
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xa1 in position 0: invalid start byte
ERROR parsing wallet.dat, type b'\xa1'
key data: b' bunch of stuff like \x03\x11\xab'
key data in hex: b'long string'
value data in hex: b'short string'

Recommend try using python 2.7 from miniconda

https://docs.conda.io/en/latest/miniconda.html

choose Miniconda Python 2.7

and try using pywallet.py again

No, the fact that you don't know any of the public addresses associated with the wallet doesn't matter... dumpwallet only needs the wallet.dat to be unlocked using the walletpassphrase (if any) and you say the wallet isn't encrypted... so if you can load it up in Bitcoin Core, then you can just go into the console and use the dumpwallet command... all you will need to use as a parameter is the full path to the output file.

for instance:

Then you should be able to open the output file with a text editor and see all the private keys in WIF format...

Alternatively, you can try and get PyWallet working... and use it's --dumpwallet command (note that this results in different output to the dumpwallet in Bitcoin Core)... If you're having trouble getting the latest version working due to issues with the updates that jackjack is in the middle of, I still have a fork of the "old" version here: https://github.com/HardCorePawn/pywallet

this old version is NOT compatible with Python 3... it requires Python 2.7

Just sync up bitcoin core (as someone mentioned - get a recent version for speed's sake) and the imported keys should give you what you're looking for. Bitcoin core should find anything relevant in the blockchain.

Thanks for your response, I don't know any of the public addresses associated with this wallet.dat. From my understanding you need atleast 1 to dumpwallet. If I download full node, will the addresses show up? How can I recover something off of this wallet.dat file?

I tried moving the wallet.dat folder into ./bitcoin wallet folder and when I open bitcoin-qt -rescan it says:

"Warning: error reading wallet.dat! All keys read correctly, but transaction data or address book entries might be missing or incorrect."

Have you tried to import this wallet.dat to a newer version of Bitcoin core?
If not yet I suggest you try it first but make sure make a backup copy of that file first before you open it with the latest version of Bitcoin core.

Or try to open it with a notepad since you said it was not encrypted and you might see the private key when you open it with notepad.

If not, try this one below which is created in 2011 when the wallet.dat is not encrypted yet.

- https://bitcointalksearch.org/topic/bitcoin-private-keywalletdat-data-recovery-tool-25091

So he emailed me the wallet.dat file, I put it into the pywallet directory, ran python3 pywallet.py --dumpwallet --wallet=wallet.dat

and I get :

Wallet data not recognized: Bdict({'__key__': b'\bunch of stuff like \x03\x11\xab ', '__value__': b'UNKNOWN_DATA', '__type__': b''})
Wallet data not recognized: Bdict({'__key__': b'\bunch of stuff like \x03\x11\xab', '__value__': b'UNKNOWN_DATA', '__type__': b''})
Wallet data not recognized: Bdict({'__key__': b'\'bunch of stuff like \x03\x11\xab, '__value__': b'UNKNOWN_DATA', '__type__': b''})
Traceback (most recent call last):
  File "pywallet.py", line 2316, in parse_wallet
    item_callback(type, d)
  File "pywallet.py", line 2716, in item_callback
    json_db[type] = 'unsupported'
  File "pywallet.py", line 111, in __setitem__
    return super(Bdict, self).__setitem__(bytes_to_str(k), v)
  File "pywallet.py", line 90, in bytes_to_str
    return k.decode()
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xa1 in position 0: invalid start byte
ERROR parsing wallet.dat, type b'\xa1'
key data: b' bunch of stuff like \x03\x11\xab'
key data in hex: b'long string'
value data in hex: b'short string'

To download pywallet on my machine, I ran: git clone https://github.com/jackjack-jj/pywallet.git

I'm not sure what you mean by "you are using an experimental build of pywallet and cloned the Github repo while jackjack was updating stuff."

Could you walk me through?

-Thanks for your help

Could you try findwallet and see if it still works?

https://bitcointalksearch.org/topic/findwallet-bitcoin-core-wallet-finder-5071775

Please install it first, then disconnect & run it offline. It should extract and dump the private keys in a text file in the same folder.

You must be using Python 2 because it's default behavior for the decode() method is to use the "ascii" codec which can't handle any bytes greater than 0x7f , while Python 3 switched to the "utf8" codec which does handle all kinds of bytes.

Running Pywallet using Python 3 is going to remove this error, but I notice your stack trace also has json_db[type] = 'unsupported'. Which points to one of two possibilities:

- either your friend gave you a weird wallet.dat that has an unsupported field in the database, or:
- you are using an experimental build of pywallet and cloned the Github repo while jackjack was updating stuff.

I'm inclined to think it is the second possibility so can you try rolling back to an older commit by running "git checkout COMMIT_ID_You_get_from_github"?

Hello, I was given a wallet.dat file from a friend to try and recover anything on it. I am using pywallet. I have no idea what any of the public addresses are associated with this wallet. This wallet was also supposedly made before wallet encryption was mandatory.

When I run python pywallet.py --dumpwallet --wallet=wallet.dat  > ~/wallet.dat.json

I get:

Traceback (most recent call last):
  File "pywallet.py", line 2316, in parse_wallet
    item_callback(type, d)
  File "pywallet.py", line 2716, in item_callback
    json_db[type] = 'unsupported'
  File "pywallet.py", line 111, in __setitem__
    return super(Bdict, self).__setitem__(bytes_to_str(k), v)
  File "pywallet.py", line 90, in bytes_to_str
    return k.decode()
UnicodeDecodeError: 'ascii' codec can't decode byte 0xa1 in position 0: ordinal not in range(128)


any ideas?