Hey guys, I screwed up and I'm trying to recover a wallet. I thought I'd give pywallet a try but I need a little assistance.
First, my situation. It's really stupid. I backed up the wrong wallet.dat file which is completely empty for some reason, it has 0 bitcoin on it. I figure the correct wallet file is located on my 500gb hdd, I THINK it's probably encrypted. If it is I know what the passphrase is. The tricky part is I formatted the drive and installed windows on it, but other than that it's not been used for any data storage or anything. I know my chances of recovery are probably low but I figure I may as well try.
The partition was probably an ext3 or ext4 parition with ubuntu installed.
I've installed pywallet on my windows 10 drive and it's working away right now, but I just wanted to clarify some things and explain what I've done.
I ran the following: pywallet.py --recover --recov_device E:/ --recov_size 500Gio --recov_outputdir C:\Users\username\desktop\pywallet
Next it asked me for 2 things, a passphrase and then another passphrase? This part I don't understand. I just put my passphrase in both times, then pressed enter and it's now working away.. it says ###.## go read now. Did I run the right command for what I need? Should I be doing this from a live usb instead, or does it matter?
If I lose the bitcoin it's not a huge deal but it would be awesome to get it back. Before this I tried a hex editor to search the raw disk but it found nothing, but I think it's because the wallet must be encrypted.
EDIT:It looks like it finished it's first run through but I'm not sure how to proceed, here's what I got:
Read 500.1 Go in 147.0 minutes
Found 1 possible wallets
Found 318 possible encrypted keys
Found 136 possible unencrypted keys
Possible wallet #1
with passphrase #1 Traceback (most recent call last):
File "C:\Users\ace--\Desktop\pywallet\pywallet.py", line 4870, in
recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
File "C:\Users\ace--\Desktop\pywallet\pywallet.py", line 1550, in recov
res = crypter.SetKeyFromPassphrase(pp, mk.salt, mk.iterations, mk.method)
File "C:\Users\ace--\Desktop\pywallet\pywallet.py", line 770, in SetKeyFromPassphrase
len(vKeyData), nDerivIterations, ctypes.byref(self.chKey), ctypes.byref(self.chIV))
WindowsError: exception: access violation reading 0x00000000B6FF9B88
There is a new file created called pywallet_partial_recovery_1494881440.dat on my desktop, but that's the only new file. Any ideas? Does this mean it actually found the wallet?
Edit 2:I've been messing around and tried it again, this time it seems to have output a recovered_wallet_1494984807.dat file. I put that into bitcoin-qt and I'm getting an error message now: "A fatal error occured. Bitcoin can no longer continue safely and will quit." Please help! Also here's some of the output I got, does this mean it worked?
Read 499.3 Go in 134.8 minutes
Found 1 possible wallets
Found 318 possible encrypted keys
Found 136 possible unencrypted keys
Possible wallet #1
with passphrase #1 ...............................
with passphrase #2
with passphrase #3
with passphrase #4
with passphrase #5
with passphrase #6
with passphrase #7
with passphrase #8
with passphrase #9
with passphrase #10
Private keys not decrypted: 1
Trying all the remaining possibilities (10) might take up to 0 minutes.
Do you want to test them? (y/n): y
Private keys not decrypted: 1
Try another password, check the size of your partition or seek help
The wallet is encrypted and the passphrase is correct
I have recovered my coins by some miracle. They were actually stored in an armory .wallet file which I used photorec to recover. I wish I could go back in time to call myself an idiot. lol
(I'm totally newbie in python).