|
Title: Searching old HD's Post by: Malawi on May 28, 2013, 10:37:42 PM I have dabbled slightly with BTC before, I remember that I dl'ed the blockchain and did some mining. Not sure if I got anything before I decided that it was not worth the hassle.
Anyways, I have a small stack of old HD's that I'm thinking of going trough, looking for a wallet. They may either be deleted or formated - most likely the latter. I am looking for some freeware that I can use to go trough these disks with, does anyone have suggestions? Title: Re: Searching old HD's Post by: alxs on May 28, 2013, 10:40:03 PM "F3" in windows ?
Title: Re: Searching old HD's Post by: 01BTC10 on May 28, 2013, 10:46:42 PM This might help: http://en.wikipedia.org/wiki/List_of_digital_forensics_tools
Title: Re: Searching old HD's Post by: philips on May 29, 2013, 07:31:05 AM Testdisk & Photorec: http://www.cgsecurity.org
Title: Re: Searching old HD's Post by: deepceleron on May 29, 2013, 12:58:42 PM The correct tool to use is pywallet, it can scan the whole hard drive raw and extract any private keys it finds. There is a thread describing how to do this.
Title: Re: Searching old HD's Post by: Malawi on May 29, 2013, 01:07:19 PM Testdisk looks promising, the forensic tools are also interesting. :)
Gotta look into pywallet - sounds very promising. But want to clarify that It's not a problem finding the file itself when they are visible to the OS. BTW: My guess is that the quickest way to find an intact wallet is to just use something like "dir \wallet.* /s" or "dir \?allet.* /s" after undeleting. Title: Re: Searching old HD's Post by: kodo on May 29, 2013, 02:27:13 PM Testdisk & Photorec: http://www.cgsecurity.org Yes this might work good. Title: Re: Searching old HD's Post by: Abdussamad on May 29, 2013, 04:32:33 PM A real bitcoin treasure hunt!
Title: Re: Searching old HD's Post by: jackjack on May 29, 2013, 09:20:04 PM Testdisk looks promising, the forensic tools are also interesting. :) Yep, pywallet will search private keys on the HDD.Gotta look into pywallet - sounds very promising. But want to clarify that It's not a problem finding the file itself when they are visible to the OS. BTW: My guess is that the quickest way to find an intact wallet is to just use something like "dir \wallet.* /s" or "dir \?allet.* /s" after undeleting. It doesn't search for a filename though as the file may have been partially rewritten. It looks for private key headers that you can find in a wallet. It'd be easier to use on Linux as AFAIK nobody tried the key recovery function on Windows. You can also use wxHexEditor (all platforms) that will basically do the same thing but it is specifically designed to search a set of bytes. It's less blackbox than pywallet. |