Author

Topic: Recover private keys from a corrupt wallet file (Read 428 times)

HCP
legendary
Activity: 2086
Merit: 4361
February 18, 2021, 02:32:27 PM
#22
Last week we cracked a multibit wallet with 11.8 BTC that had been inaccessible since 2013 and presumed corrupt.
So, it wasn't actually corrupt, just an incorrect password was being used? Huh Did the user actually recognise the password that was found or had the application applied some random/different password? Huh

There seem to be a lot of users with multibit wallets that claim their passwords don't work... and they're 100% sure the password is correct. Since BTC broke $50k, I've been getting an average of 1 PM a day from someone struggling with old MultiBit wallets... it would be nice to know if they just have the passwords wrong, or if the application did "something dumb" and encrypted the wallet using a different password/key or something.
newbie
Activity: 1
Merit: 0
OP, please be careful with newbies trying to help you.

Especially if they claim to be some sort of "wallet recovery" or similair.

There is only one trusted wallet recovery service. And that's Dave's recovery service. You should assume every newbie contacting you is a scammer.
Just because someone has recovery in their name, doesn't mean they actually know what they are doing.

17th Feb 21: Last week we cracked a multibit wallet with 11.8 BTC that had been inaccessible since 2013 and presumed corrupt. It can be done. That is the reason for this newbie post because leveraging the power of cloud computing it was possible to run over 1 billion combos and crack the wallet password in just 36 seconds. So if you want to take a chance for a 20% fee of the wallet value please get in touch. [email protected] we will have a website up and running to support this in due course.
legendary
Activity: 1624
Merit: 2481
OP, please be careful with newbies trying to help you.

Especially if they claim to be some sort of "wallet recovery" or similair.

There is only one trusted wallet recovery service. And that's Dave's recovery service. You should assume every newbie contacting you is a scammer.
Just because someone has recovery in their name, doesn't mean they actually know what they are doing.
newbie
Activity: 9
Merit: 0
Looks like this is double posted, and the other thread is more thorough. Suggest this thread to be closed.
newbie
Activity: 9
Merit: 0
Well, I am gonna post the guide here in public so anyone can object, but instead of writing guides for every OS it is less time consuming to know which OS the user is currently using. Yes, I am a newbie in this forum, but if that means I shouldn't contribute then I'll keep my mouth shut and let the legends speak. Cheers.
hero member
Activity: 2660
Merit: 651
Want top-notch marketing for your project, Hire me
I only found the wallet file, but it looks damaged
A piece of advice, Be careful because I don't support the part of allowing a newbie to do any check the contents of the wallet that is damaged and I don't understand why you choose not to provide an answer to the HCP question while you reply to the newbie's question.
Note : Multibit was said to be defunct since 2017
newbie
Activity: 9
Merit: 0
I see. Is it okay if I guide you through some steps that require the use of Linux/UNIX? I wonder if it is possible to reconstruct the wallet, but in order to do so we need to check what contents of the wallet that is damaged. Just let me know which OS you're comfortable with and I'll try to summarize a guide.
copper member
Activity: 10
Merit: 0
I only found the wallet file, but it looks damaged
newbie
Activity: 9
Merit: 0
Did you find any other files related to the MultiBit installation? Like .key-files or anything else, or just the .wallet-file?
copper member
Activity: 10
Merit: 0
The entire unit was scanned, sector by sector with a forensic system by a company regarding the file wallet
member
Activity: 378
Merit: 53
Telegram @keychainX
Unfortunately I had already performed the search with the HxD editor of the hexadecimal progression 0201010420, but did not find this string on the file which is still partially corrupted.

Did you ever scan the whole drive on sector level for this string or just the corrupt file?
copper member
Activity: 10
Merit: 0
Unfortunately I had already performed the search with the HxD editor of the hexadecimal progression 0201010420, but did not find this string on the file which is still partially corrupted.
HCP
legendary
Activity: 2086
Merit: 4361
I'm trying to use the GitHub and Python program, but I'm struggling, I'll try everything this weekend and I'll let you know, for the moment thank you very much.
In this wallet there are 29 BTC, I have to try them all before giving up ..
If you need any further help, just ask here... It's been quite a while since I did any work with MultiBit Classic wallets... but they were relatively "simple" protobuf format wallet files that were based on "BitcoinJ". If they're not too badly damaged, it might be possible to use the Python scripts (might need some minor modifications? Huh) to at least dump out the raw wallet file in "plaintext".

Do you know if the original wallet file had a password/was encrypted? If it was, that might complicate things a little bit... especially if the file is corrupted/partially overwritten. Undecided

Also, what is the exact filename(s) of the multibit file(s) that you have recovered? Huh There were .wallet files, .key files and possibly .wallet.cipher files...
jr. member
Activity: 189
Merit: 1
 Hi  if you use Hex editor then you can scan the hard drive or folder for this hex number 0201010420. The 32 bytes of data or 64 character following that string should be a private key in hex. You can use tools like bitaddress.org to convert that hex to a private key in WIF format that could be imported in a wallet. So when you see 0201010420 then count 64 characters after it. Then paste it to wallet details tab at bitaddress.org. Make sure you do it offline on the website.  This should give you the Wif format. Then you can take this number and copy it to a wallet that supports Wif. Thanks, hope to get reward for the help.
newbie
Activity: 9
Merit: 0
Sure, there's been lots of issues with old Multibit wallets so there are more options to try if this doesn't work out. Hope it helps though:)
copper member
Activity: 10
Merit: 0
I'm trying to use the GitHub and Python program, but I'm struggling, I'll try everything this weekend and I'll let you know, for the moment thank you very much.
In this wallet there are 29 BTC, I have to try them all before giving up ..
newbie
Activity: 9
Merit: 0
Is MUltibit Classic 0.5.17
Have you tried running the script above? If it doesn't work, one of the forum members here (HCP) has made a script that might help you. Check out this thread and let me know how it turns out: https://bitcointalksearch.org/topic/m.19300634
copper member
Activity: 10
Merit: 0
Is MUltibit Classic 0.5.17
newbie
Activity: 9
Merit: 0
I will advice you to not let anyone to scam you promising you to recover it demading for bitcoin or other money.
+1 to that. If you indeed have a file named multibit-.key in the Multibit-folder, it might be possible to obtain the private keys, but as Oshosondy said: do not hand over anything to others. Instead, let users here guide you through the process (in public, not by PM), or try this tool on your corrupted wallet to see if the script is able to read more data than the Multibit application: https://github.com/Multibit-Legacy/read-multibit-wallet-file
legendary
Activity: 1624
Merit: 1200
Gamble responsibly
You will need the private key to restore your wallet, or if it is seed phrase, and you said the back up file was formated and you were not able to get back the wallet file, I think you can not recover back your wallet. You should have written the private key offline and checking that it is 100% correct, you can not only depend on what can be lost or damaged like devices to store your private key. Also, you can have external devices like two or three cards or hard drives for the wallet backup instead of having it on the computer only, having two to three backup will be better in case of next time. I will advice you to not let anyone to scam you promising you to recover it demading for bitcoin or other money.
newbie
Activity: 9
Merit: 0
Is it Multibit Classic or HD? Do you still have the key(s) located in MultiBit-folder? If so, I'll write you a description on how to do it here.
copper member
Activity: 10
Merit: 0
Good morning,
I have a problem with my wallet file.
The Multibit application cannot read the wallet because it was damaged with an overwrite and therefore I cannot have the BTC acquired in 2014.
I would like to understand if it is possible to trace my private key and recover the BTC inside the damaged wallet file.
The pc containing the wallet file was formatted and reloaded the operating system, subsequently when I realized that I did not save the private keys correctly I recovered the wallet file, but it is partially overwritten and not readable by Multibit.
I tried to open it with the HxD editor program to check if my private key was intact anyway, and I tried to open some 32 Byte strings hexadecimal and I read them with the bitaddress.org program, but here I stopped.
Can't figure out what the exact 32-byte srtring is.

I offer a reward to anyone who will be able to help me find my private key
Jump to: