Title: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 17, 2013, 11:19:41 AM 1) I had a Linux system with many wallets ,bitcoin, litecoin, devcoin, etc. and due to immense stupidity forgot to backup the hidden dot.folders ( .litecoin , .namecoin ... ) - where the wallets are - upon reinstalling a new OS
2) After deleting the partition and just before starting installing a new OS I cancelled this so the disk is still empty - no files were written over it ... this is why I have hope 3) I tried this tool: http://www.btcnn.com/2011/09/recovering-lost-due-to-format-bitcoin.html - it did recover around 555 keys ... but it saves them all in one .dat - how can I ever import them unto many wallets? 4) I tried using PhotoRec to recover the .dat files using this : http://www.cyplo.net/2012/04/01/bitcoin-wallet-recovery-photorec/ - guide this looks better since it saves many .dat files ... but some are 180 KB, some are 300 KB, some are 1 MB, some 600 MB (?) I tried running *coin in a LiveCD environment and replacing wallet.dat with each of those files but it doesnt work. --- I'm about to give up ... any ideas? I'll reward the person who can help Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 17, 2013, 11:26:02 AM Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet.
If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 17, 2013, 11:58:45 AM Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet. If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes. Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it. It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk ) So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 17, 2013, 12:05:19 PM Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet. If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes. Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it. It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk ) So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins It definitely works on Linux, I tested it myself. Also, as it looks for private keys, all your private keys are put in the recovered wallet. Bitcoin, Litecoin or whatever. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 17, 2013, 04:33:29 PM Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet. If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes. Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it. It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk ) So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins It definitely works on Linux, I tested it myself. Also, as it looks for private keys, all your private keys are put in the recovered wallet. Bitcoin, Litecoin or whatever. This is amazing, thank you. Are you the creator of this tool? It's a life safer. I'm doing the raw recovery now & it will take some time. Excuse the (probably) dumb question, but what is "Gio"? Is it the same as gigabytes? 1 Gio = 1 GB ? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 17, 2013, 05:05:18 PM It managed to import just a few keys (2 or 3) and then gave me this error:
Quote Traceback (most recent call last): File "./pywallet.py", line 4438, in <module> importprivkey(db, sec, "recovered: %s"%sec, None, True) File "./pywallet.py", line 2291, in importprivkey crypted = 'salt' in json_db['mkey'] KeyError: 'mkey' xubuntu@xubuntu:~$ Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 17, 2013, 05:31:35 PM Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet. If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes. Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it. It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk ) So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins It definitely works on Linux, I tested it myself. Also, as it looks for private keys, all your private keys are put in the recovered wallet. Bitcoin, Litecoin or whatever. This is amazing, thank you. Are you the creator of this tool? It's a life safer. I'm doing the raw recovery now & it will take some time. Excuse the (probably) dumb question, but what is "Gio"? Is it the same as gigabytes? 1 Gio = 1 GB ? I added the rest, including the recovery. 'o' means 'B'. Pywallet accepts both. And the 'i' indicates that you're using a binary prefix. http://en.wikipedia.org/wiki/Binary_prefix (long story short, 1024**3 instead of 1000**3) Both binary and SI prefixes are accepted. As for the error, I'll look at that right now Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 17, 2013, 05:35:53 PM Done Edit: Are your wallets encrypted? Because I just remembered they can't be recovered (the recovery feature is old and never draw much attention) but I can add this if you need it. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 17, 2013, 05:44:06 PM Done Edit: Are your wallets encrypted? Because I just remembered they can't be recovered (the recovery feature is old and never draw much attention) but I can add this if you need it. You're the best. :) Yes, they were encrypted. Would it be possible to recover those? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 17, 2013, 05:58:25 PM I'm glad it's appreciated!
It will be possible if there's a common pattern. I'm working on it now, I'll come back to report any info. Also, maybe there's still a copy of your wallets before you encrypt them on the disk, so try anyway with the current version. Edit: Wow, that's soooo slow! I'll try to make it faster once I'm done with encrypted wallets support Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 17, 2013, 06:53:40 PM Good news, I found the pattern.
How much time can you wait by the way? Could you wait for a few days? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 17, 2013, 09:53:00 PM Good news, I found the pattern. How much time can you wait by the way? Could you wait for a few days? Awesome!! I'm so happy to hear. Sure I will wait - the only alternative is loosing all the coins from all the wallets! I can work on my PC anyway ... this Xubuntu USB Live OS is good enough for the time being. I won't touch the drive of course. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 17, 2013, 09:54:26 PM Also import finished, with your new pywallet:
Importing key 111/111: Address (Bitcoin): 1BKGXf9pFg14XK38Sbj6w44dLE3jYABZdp It seems though only addresses starting with "1" were found. Not sure which wallet was that. I had lots of Worldcoins for instance but no address starting with "W" was found. I wonder if it's because it was encrypted? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 17, 2013, 11:17:05 PM All the addresses found will have the Bitcoin format. Keep in mind that this format in nearly never used in the wallet (only for labels) though.
AFAIK all the altcoins have the same wallet format than Bitcoin, so putting the recovered wallet in the altcoin dir and making a rescan should (must!) work. Also, yes the current pywallet won't ever find any encrypted key so that's why. By the way, everything's working now. I still have to make things clean, pretty and practical but it's definitely working with encrypted private keys. I'll push the update in around 24 hours. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 18, 2013, 08:33:29 PM I don't have access to a Linux computer for the whole week-end... And Windows refuses to let me read raw disks correctly so you'll have to wait a bit more.
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 19, 2013, 06:43:51 PM Ok, use pywallet 2.1.0b1: http://pastebin.com/raw.php?i=zU2x7amw
The recovery now runs with encrypted+unencrypted on linux+windows Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 19, 2013, 08:37:31 PM Ok, use pywallet 2.1.0b1: http://pastebin.com/raw.php?i=zU2x7amw The recovery now runs with encrypted+unencrypted on linux+windows Wonderful! Going to try it now. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 19, 2013, 10:18:57 PM I'm having some problems running it. I'm currently in a Linux LiveCD environment (running Manjaro which is a Arch-linux based distro, from an USB key). I tried to run the py with ./sudo pywallet.py after having chmod +x it, and it gives me this:
Code: [manjaro@manjaro Code]$ ls I thought it was a problem of me not having the bsddb that you write is a requirement, so I installed it, but it's still the same. Code: [manjaro@manjaro Code]$ python --version Within the list of modules, I see a long list, the relevant part is here: Code: [b]...[/b] If I try to run it like this, I get the following error: Code: [manjaro@manjaro Code]$ sudo python pywallet.py What do you think could be the issue? Should I load Ubuntu on the USB instead? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 19, 2013, 10:20:53 PM Yeah sorry I'll put a specific error about that... You need python 2.*, pywallet can't run with python 3
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 19, 2013, 10:22:17 PM Yeah sorry I'll put a specific error about that... You need python 2.*, pywallet can't run with python 3 oh, thanks for the fast reply!! Got it! Let me retry with python2 Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 19, 2013, 10:24:22 PM I just tried
Code: sudo python2 ./pywallet.py and it works!! Going to run the recover now This is quite the adventure. I'd never thought something like this could be fun, but it actually is in a strange way , even though real money is at stake ... ! Fingers crossed now Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Kouye on July 19, 2013, 10:35:05 PM Agreed, I had to install, had pywallet working - I didn't have python on my computer, and understand how to use it...
Was a lot of fun, even more since I managed to google for it from scratch, and finally succedeed. Great tool, I agree with D&T it's a shame jackjack didn't receive more tips for it. Sending one (small tip, I'm pooooor!!!) now, in memory of this precious moment where it worked. :D Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 19, 2013, 10:42:43 PM Works now, it asks me for all the passphrases, I typed all the passes that I remember - I'm sure about the passes for the most important wallets - ... after all this, it gives me this:
Code: Starting recovery. Which is odd, since I am running this as root, and /dev/sda is the right path: Code:
Is it because I run it with "python2 pywallet.py" instead of "./pywallet.py" - I think it shouldn't matter, I still ask Otherwise I'll try a different Linux LiveCD. Sorry for so many questions. As Kouye has said you deserve fat tips for your work, when I get my hands on the lost coins I will donate a significant amount of my coins. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 19, 2013, 10:49:17 PM Thanks for the kind words+tips guys :)
Praxis: Try with a specific partition, like /dev/sda1 I never tried the whole disk sda so I'm not sure it works Is it because I run it with "python2 pywallet.py" instead of "./pywallet.py" NopeAnd changing the LiveCD shouldn't change anything Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 12:13:40 AM Same error if I run with /dev/sda or /dev/sda1 or /dev/sdaX... "Can't open /dev/sda, check the path or try as root" ...
But with the old version of pywallet, I ran it on /dev/sda and it worked well. In fact, the old version works on /dev/sda or any other, /dev/sdax I just tried again the old version : Code: [root@manjaro Documents]# python2 pywalletOld.py --recover --recov_device /dev/sda --recov_size 30Gio --recov_outputdir /home/manjaro/Documents/ My partition table is currently a clusterfuck but it shouldn't be the reason, since with old pywallet I can scan /dev/sda directly. It's really strange, I can't understand. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 20, 2013, 01:14:01 AM I'm using windows since yesterday so I think I made a windows fix that broke it...
Sorry for this, I'll give it a look a bit later Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: scintill on July 20, 2013, 02:05:20 AM Have you tried guessing the old partition table with gpart? Gparted has a nice UI frontend that will scan for partitions, then let you mount them.
If all that's happened is your partition table is gone, you have pretty good chances of finding your filesystems entirely intact, you just have to find where they are located on the disk. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 02:17:20 AM Have you tried guessing the old partition table with gpart? Gparted has a nice UI frontend that will scan for partitions, then let you mount them. If all that's happened is your partition table is gone, you have pretty good chances of finding your filesystems entirely intact, you just have to find where they are located on the disk. Thanks for the ideas. Problem is, I made new partitions, not just deleted the old ones.haven-t done anything except making new partitions though. No idea how Gparted could restore my old partition table ... the good news is that I feel I'm really close to recovering wallets with jackjack's pywallet after he made the changes to scan encrypted wallets Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: trilightzone.org on July 20, 2013, 04:15:02 AM Have you tried guessing the old partition table with gpart? Gparted has a nice UI frontend that will scan for partitions, then let you mount them. If all that's happened is your partition table is gone, you have pretty good chances of finding your filesystems entirely intact, you just have to find where they are located on the disk. Thanks for the ideas. Problem is, I made new partitions, not just deleted the old ones.haven-t done anything except making new partitions though. No idea how Gparted could restore my old partition table ... the good news is that I feel I'm really close to recovering wallets with jackjack's pywallet after he made the changes to scan encrypted wallets Maybe for the next time but if something like this happens it's important to first make a raw disk image and store it somewhere as a backup. Then work on the drive to get your data back. In case something goes wrong you at least have a raw backup image of the drive. Hope with the good tools in this thread you'll get everything back or at least the important wallets ! Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: scintill on July 20, 2013, 04:40:44 AM Thanks for the ideas. Problem is, I made new partitions, not just deleted the old ones.haven-t done anything except making new partitions though. No idea how Gparted could restore my old partition table ... the good news is that I feel I'm really close to recovering wallets with jackjack's pywallet after he made the changes to scan encrypted wallets It depends, if by "make" new partitions that includes formatting them, then it does hurt your chances pretty badly. Gparted scans the disk for filesystem signatures and can deduce the partitions' start and size from those. If all you've done was delete the partition table and allocate space for new partitions, those signatures and all the rest of the data needed to store the old files would still be there. Even if you formatted the new partitions, it might still be able to find something if the beginnings of the old and new partitions happened to be far enough apart, but it seems like a slim chance, and maybe you don't need to try it if you're making progress with pywallet. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 20, 2013, 08:52:27 AM Pretty dumb I don't print the error when it crashes...
Done here 2.1.0b3: http://pastebin.com/raw.php?i=pXXh2bNF You will still get the "path or try as root" error but the line just below will give some additional details Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 12:58:32 PM Code: Starting recovery. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 20, 2013, 01:06:34 PM 2.1.0b4 should work: http://pastebin.com/raw.php?i=wmXTdQrf
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 01:28:31 PM Works!! You're awesome! I run the proccess now
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 20, 2013, 01:32:28 PM Great :)
Good luck Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 03:55:59 PM I think these might be some great news :
Code: 640.00 Go read So, it works! Even for encrpyted wallets! As far as I know pywallet is now the only program that can do this Problem is, I can't find the output wallet. This was my parameter in the command line: Code: --recov_outputdir /home/manjaro/Documents/ The folder exists and I ran it as root so there is write access. But the file isn't there after it finished. Sorry for nagging you so much :-[ Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 04:00:17 PM Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly.
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 20, 2013, 04:02:52 PM Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly. That's exactly what I was about to ask you: did it stop just after "Possible wallet #1 with passphrase #1 "? Nothing printed after this?If so, it definitely crashed I'll try to see what could have happened and report here Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 04:50:04 PM Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly. That's exactly what I was about to ask you: did it stop just after "Possible wallet #1 with passphrase #1 "? Nothing printed after this?If so, it definitely crashed I'll try to see what could have happened and report here Yes. If there's any other information I can give, let me know. Anything that could help. Sadly my Python skills don't go a lot further than a hello world program. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 20, 2013, 05:04:40 PM For now I really don't see what could make it crash
Also you'll have to scan all the drive again the next time you'll run the recovery I'm sorry for that... Good news though, I just coded the creation of a partial file that keeps useful offsets before the crash, so you'll have to run the long disk reading only once more (you should do it now) You don't have anything special to do: run the same command and pywallet will save 'pywallet_partial_recovery_timestamp.dat' in the outputdir before crashing Next time you run a recovery, change Code: --recov_device=c:\ Code: --recov_device=PartialRecoveryFile:c:\path\to\pywallet_partial_recovery_timestamp.dat 2.1.0b5 http://pastebin.com/raw.php?i=xi4ivsCH Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 07:53:45 PM Yay, I have a pywallet_partial_recovery_timestamp.dat file now.
If I load it in, say, Worldcoin, it gives me an error. I think I should run pywallet ON this file now to extract the crypted keys from it somehow? If I just put -recov_device as the file instead of /dev/sda like you said, it still crashes like before Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 20, 2013, 09:05:56 PM This file is not a wallet at all, it's just the list of the places where pywallet found keys.
Thus this avoid to read the disk again: pywallet just has to look around these places. So you don't have to wait 3 hours each time you try the recovery For now I didn't try any fix so it's normal it crashes like before. The goal was only to create this intermediate file. Try this (using the partialrecoveryfile:, as you will always do from now on) and post all the output 2.1.0b6 http://pastebin.com/raw.php?i=UeavfR1a Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 20, 2013, 11:46:50 PM I ran it with the file, not /dev/sda, like you said:
Code: Possible passphrase: Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 01:10:10 PM Odd
Do you have strange/UTF8 characters in your passphrase? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 02:09:14 PM Odd Do you have strange/UTF8 characters in your passphrase? only alphanumeric mixed with few symbols such as ! , # , % , & , ... but now that I think of it, when I encrypted the passwords, I was using a Slovenian keyboard / encoding, which is basically like American plus a few extra characters... and the keys are placed a bit differently could that be the reason? (even though I did not use those special Slovenian characters in the passwords) Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 02:42:30 PM I can't reproduce it
Try with random passphrases containing only alphanumeric characters Does it crash too? but now that I think of it, when I encrypted the passwords, I was using a Slovenian keyboard / encoding, which is basically like American plus a few extra characters... and the keys are placed a bit differently Maybe but not likely if there is no Slovenian character in the passphrasecould that be the reason? (even though I did not use those special Slovenian characters in the passwords) I'll try other things when I'm back home in a few hours Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 06:35:24 PM Code: [manjaro@manjaro Documents]$ sudo python2 ../Downloads/pywallet.py --recover --recov_device=PartialRecoveryFile:./pywallet_partial_recovery_1374430501.dat --recov_outputdir /home/manjaro/Documents/ --recov_size 640.1Gio Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 06:47:34 PM Try this one and post the lines beginning with "crypter" and "skfp": http://pastebin.com/raw.php?i=0SMbAwat (with random passphrases too as it will print the passphrase you entered)
I'm sorry to make you try files so many times... Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 07:04:19 PM It is I who am sorry for all these complications and deeply thankful for your help.
I attach a picture because I'm worried copy/paste wouldn't reproduce the strange characters it outputs: https://i.imgur.com/dkAVLJn.png Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 07:15:13 PM This seems desperately normal...
This one? http://pastebin.com/raw.php?i=PgXbLpdL Ok I'll tell you what I'm doing, that would be less annoying for you. I found the function that crashes but I don't understand why it crashes without printing any error as it should. Also I don't even understand why it is crashing at all. The last version prints something after each line within that function so that I'll know which one crashed. Did you compile ssl yourself? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 07:22:17 PM Thank you for the information. I will try the other file now.
I did not compil SSL myself. I'm using a LiveCD of Manjaro which is a version of the rolling-release Arch distribution. Here's verbose information output on SSL version: Code: [manjaro@manjaro Downloads]$ openssl version -a Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 07:26:11 PM Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 07:35:41 PM Good idea posting the openssl version. I have 1.0.1c but I highly doubt this comes from that. I'll check though.
About the error, please delete these two lines and try again: line 769: print strKeyData.encode('hex') line 772: print chSalt.encode('hex') Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 08:20:07 PM Code: Possible wallet #1 Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 08:28:57 PM I'm really starting to think this comes from openssl
http://pastebin.com/raw.php?i=1QyNB5Af Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 09:04:57 PM Code: Possible wallet #1 Perhaps I should just try another distribution that has another version of openssl? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 09:06:22 PM Yes, please try another distribution if you can
Don't forget to keep pywallet_partial_recovery_1374430501. Do you have an exotic hardware? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 09:27:24 PM Quote [manjaro@manjaro Documents]$ sudo hdparm -I /dev/sda /dev/sda: ATA device, with non-removable media Model Number: WDC WD6401AALS-00L3B2 Serial Number: WD-WCASY4710125 Firmware Revision: 01.03B01 Transport: Serial, SATA 1.0a, SATA II Extensions, SATA Rev 2.5 Standards: Supported: 8 7 6 5 Likely used: 8 Configuration: Logical max current cylinders 16383 16383 heads 16 16 sectors/track 63 63 -- CHS current addressable sectors: 16514064 LBA user addressable sectors: 268435455 LBA48 user addressable sectors: 1250263728 Logical/Physical Sector size: 512 bytes device size with M = 1024*1024: 610480 MBytes device size with M = 1000*1000: 640135 MBytes (640 GB) cache/buffer size = unknown Capabilities: LBA, IORDY(can be disabled) Queue depth: 32 Standby timer values: spec'd by Standard, with device specific minimum R/W multiple sector transfer: Max = 16 Current = 1 Recommended acoustic management value: 128, current value: 254 DMA: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 udma5 *udma6 Cycle time: min=120ns recommended=120ns PIO: pio0 pio1 pio2 pio3 pio4 Cycle time: no flow control=120ns IORDY flow control=120ns Commands/features: Enabled Supported: SMART feature set Security Mode feature set * Power Management feature set * Write cache * Look-ahead * Host Protected Area feature set * WRITE_BUFFER command * READ_BUFFER command * NOP cmd * DOWNLOAD_MICROCODE Power-Up In Standby feature set * SET_FEATURES required to spinup after power up SET_MAX security extension Automatic Acoustic Management feature set * 48-bit Address feature set * Device Configuration Overlay feature set * Mandatory FLUSH_CACHE * FLUSH_CACHE_EXT * SMART error logging * SMART self-test * General Purpose Logging feature set * 64-bit World wide name * Segmented DOWNLOAD_MICROCODE * Gen1 signaling speed (1.5Gb/s) * Gen2 signaling speed (3.0Gb/s) * Native Command Queueing (NCQ) * Host-initiated interface power management * Phy event counters DMA Setup Auto-Activate optimization * Software settings preservation * SMART Command Transport (SCT) feature set * SCT Read/Write Long (AC1), obsolete * SCT Write Same (AC2) * SCT Error Recovery Control (AC3) * SCT Features Control (AC4) * SCT Data Tables (AC5) unknown 206[12] (vendor specific) unknown 206[13] (vendor specific) Security: Master password revision code = 65534 supported not enabled not locked not frozen not expired: security count supported: enhanced erase 118min for SECURITY ERASE UNIT. 118min for ENHANCED SECURITY ERASE UNIT. Logical Unit WWN Device Identifier: 50014ee257f47641 NAA : 5 IEEE OUI : 0014ee Unique ID : 257f47641 Checksum: correct Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 09:28:28 PM Gonna try with a more standard/stable live distro.
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 09:29:43 PM And your computer? Processor? Nothing special?
Gonna try with a more standard/stable live distro. I hope it will helpTitle: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 09:33:35 PM Nothing out of the ordinary. It's a DELL Inspiron 531 (desktop PC)
model name : AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 21, 2013, 09:35:18 PM Ok then my guess it definitely openssl
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 21, 2013, 11:15:26 PM Wow, seems to work now !! ;D
Code: Private keys not decrypted: 5012 It seems it already found many encrypted keys, but why does it go into this 18 hour process now? isn't it very likely it already found the right wallet(s) in the first step (where it tried the pass on the 42 possible wallets)? Or am I off the mark? Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 22, 2013, 06:45:23 AM First it tries to decrypt private keys only with the closer encryption parameters. Then if some private keys that are still not decrypted it will try all the remaining parameters (42 in your case).
I'll add a prompt to know if you want to stop after the first guesses. I think too that it should be enough here. The other wallets may be altcoins you briefly tried. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 22, 2013, 08:30:57 AM New and possibly last version: http://pastebin.com/raw.php?i=wuEZTqeL
You'll see things like this Quote Possible wallet: #1 Which shows you which passphrase unlocks which walletwith passphrase #1 with passphrase #2 ............ with passphrase #3 with passphrase #4 Possible wallet: #2 with passphrase #1 with passphrase #2 with passphrase #3 ............ with passphrase #4 Then Code: Private keys not decrypted: %d Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 22, 2013, 08:20:21 PM Man, this last version works like a charm! I could run it with 6 passes and it created a recovered.dat! :D
I just replaced the wallet.dat without downloading the blockchain first: Code: ************************ worldcoin-qt gives me this I will try to replace the wallet.dat AFTER downloading the blockchain with a fresh wallet.dat I tried running both with -rescan and -detachdb Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 22, 2013, 08:39:42 PM I'm glad it finally works!
"Permission denied" doesn't seem to be a problem from the wallet. If it doesn't work please try with bitcoin-qt as worldcoin devs might have a different code (that I wouldn't plan to support in pywallet). Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 23, 2013, 02:17:15 AM I'm glad it finally works! "Permission denied" doesn't seem to be a problem from the wallet. If it doesn't work please try with bitcoin-qt as worldcoin devs might have a different code (that I wouldn't plan to support in pywallet). Yeah, it say something like unable to load keypool or something like that now. If the .dat is not "made" for other clients, perhaps I could try to import the keys one by one into the other clients or something. I'll try to figure something out tomorrow. Or maybe I should stop being lazy and learn Python so that I can contribute something :) Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 23, 2013, 08:05:00 AM I know the keypool is empty, I may add keys if it avoids the error
Could you post it? I really think all the wallets have the same format Also, importing a key takes 0.5 second so it may take long But yeah learning Python could be nice, even for you! Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 23, 2013, 06:27:04 PM I know the keypool is empty, I may add keys if it avoids the error Could you post it? I really think all the wallets have the same format Also, importing a key takes 0.5 second so it may take long So it means it should be possible, in theory, to recover even non-bitcoin wallets (alt-coins)? I'm ashamed to admit but I don't understand what is a keypool or how to post it here. I'm reading and Googling about these things now. I will try to educate myself. Does the following apply - should I 'dump' my recovered wallet? Code: pywallet.py --passphrase="pass" --dumpwallet > dump.decrypted.txt I guess I'm still confused about how to get the coins even if I have the recovered wallet. I'm trying to figure it out. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 23, 2013, 06:48:05 PM I'm pretty sure that pywallet found your altcoin wallets.
Again, except maybe for some crazy ones. Try pywallet to dump a wallet from an altcoin, if it works, it's 99% sure the recovery would work The keypool is a set of 100 (by default, but you can change it) "hidden" addresses. They are used for change (and generation if you are a miner). By the way, you can add a pool address yourself. Using the pywallet WUI you can add a dummy address (private key = '000...001' for example) to a wallet and tell it to make it a pool address. If you have the recovered wallet, rename it 'wallet.dat' and put it in the bitcoin directory (~/.bitcoin) without forgetting to backup the current wallet.dat. Then Quote bitcoin-qt -rescan Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on July 25, 2013, 03:49:05 PM If you have the recovered wallet, rename it 'wallet.dat' and put it in the bitcoin directory (~/.bitcoin) without forgetting to backup the current wallet.dat. Then Quote bitcoin-qt -rescan This worked. Since the wallets were not bitcoin wallets, even though Bitcoin recognizes the recovered wallet, it cannot detect or use the coins transferred to those addresses, normally, because they are alternative chains. I'm pretty sure the structure of wallet.dat is same for all coins (what could be different, after all)? The changes within the coins is not related to the BerkeleyDB file. What I'll try next is ... dump the keys from the recovered.dat and import them into an already-existing working Alt-coin wallet. I think this should solve the problems. Looking for an elegant way to do this fast with Pywallet now. Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on July 25, 2013, 03:59:20 PM Great, now do the same thing with an altcoin client and it should work too
Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: Praxis on November 25, 2013, 04:17:17 PM Great, now do the same thing with an altcoin client and it should work too Sorry for bringing this up again. you worked so hard to help me, I feel in your debt After all this time I still haven't given up completely! Just took a long pause from this process. I never could get the coins back. I still have the recovered .dat files ... It just didn't load them into the *coin clients (if I replaced the wallet.dat) Now I think it's simply because pywallet recovers only Bitcoin addresses if I look into the recovered dat, all addresses start with "1" which is Bitcoin Worldcoin addresses start with "W", for instance Title: Re: [Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive Post by: jackjack on November 25, 2013, 04:48:36 PM There is no addresses in the wallet files, there are only private and public keys (which do not contain '1' or 'W') so there is no difference between a Bitcoin wallet and a Litecoin one
I'm really interested in your recovered .dat files to see what could cause the problem If you're OK with that, consider sending the bit/altcoins it contains to other addresses first Maybe I'm wrong and I forget some settings that must contain an address, but even if it's the case your altcoin private keys must have been recovered |