Bitcoin Forum

   I have an old computer that may still have Bitcoin on it and need some help sifting thru the data. The hard drive was either formatted and reloaded with Windows 7 at the time or rolled back to an earlier date. I tried EaseUS Recovery and found files from around the time the wallet would have been created. There are .dat files but none that are wallet.dat.

Is it possible that one of those could be the necessary file and the recovery software changed the name?


Are there any specific key formats,code or files I can search for in all the recovered data?

 

I also have a few IE indexes. Is there a way to search those to maybe see a public id or wallet id that was typed in?       I do remember using Blockchain.info to check a few times (2011).

 
  I did not set this up personally back then. I was asking a friend about Bitcoin since someone asked me if they could use it as payment and he set up an account for me. This would have been September to December 2011 or possibly September to December 2010. What I do remember is that he had to download the entire blockchain to his laptop before he set up my account. What I don't remember was if he did the same to my little mini laptop. It's entirely possible all of the data was set up on his laptop and he just gave me the public and private id. Does this make any sense? I do remember setting up a password and re-typing a seed with randomly generated words (can't find). Was the SMS confirmation available at this time as well? I vaguely remember doing this but could be wrong. Is this all something that could be set up with just a desktop wallet?

  Any help would be greatly appreciated and rewarded if this can be recovered. It's driving me crazy as it's simultaneously the best and worst thing to remember about.

What were the names of the files?

Sometimes files get added with "random" characters when the names can't be found. E.G with some recovery clients, I might find a 0000001.dat or other alphanumeric titles that don't make much sense. Maybe this is what you have found? Can you post their names? Did you have any other cryptoclient software also, like Litecoin maybe?

{88A16072-xxxx-xxxx-xxxx-xxxxxxxxxxxx}.dat
FontCache-S-1xxxx.dat
tokens.dat
index.dat
cache.dat
Schema.dat{xxxx-xxxx...}
index48a.dat
index48b.dat

 I wish I knew what was installed at the time but unfortunately someone did it all for me back then.

I'm not entirely sure what to suggest straight away from here, but can you open each file in a text editor and search for things that would normally be in a bitcoin core wallet.dat (such as a search for the term "keymeta" and see if that's there).

I'll keep searching for other stuff but I can only see a lot of derivation paths in my wallet.dat at the moment.

If your text editor works right and the search for keymeta returns something, you should be able to see below it two words "purpose" with your address and a "recieve" before those two.

  The index.dat file for the date I had in mind seems to be encrypted?? When I open it in the recovery preview it just shows a bunch of    |oi 3/4 3/4 3/4 |oi 3/4-3/4-3/4-3/4  URL: YYYYYYYYY |oi 3/4-3/4-3/4 etc...

   Any hope there? The file is 256.00 KB

You should still be able to find those words if your wallet is encrypted (I just encrypted mine and did a search and noticed they were still there).

Encrypting just encryptes the private keys.

To lessen your workload, move the .dat files that comes with the names: index, data, cache and user.
A ".dat" file is commonly used by applications as a generic data file.
Your wallet.dat couldn't be named like those except if you intentionally named it that way.

A "shortcut" would be to simply run PyWallet recovery across the disk that possibly had the wallet.dat on it... if there is a "recoverable" wallet file or key data, it should find it.

You can read more here: https://bitcointalk.org/index.php?topic=34028.0
The instructions for recover is here: https://bitcointalk.org/index.php?topic=38004.0

However, if the drive has been formatted/re-used, your chances of recovery are not great. You should probably also consider making an image of the drive, rather than working directly on the drive to prevent any further accidental data loss.

If it was blockchain.info, you're probably not going to find anything useful in recovered files... the system stores your encrypted wallet on blockchain.info servers... you need your wallet ID and password to be able to download and decrypt the file.


Honestly, you seem to have "remembered" pretty much all the various features of all the various bitcoin wallets :-\ downloading blockchain = Core, using blockchain.info, SMS auth, using a seed mnemonic etc...

If you used a recovery seed mnemonic, then it most likely won't be a wallet.dat... and it isn't likely to be a Bitcoin Core (aka BitcoinQt) wallet.dat file that you're looking for. Although newer versions of Bitcoin Core are "HD" and derive addresses from "seeds" they have never used BIP39 backup seed mnemonics. Bitcoin Core has always relied on making backups of the wallet.dat for recovery purporses.

Given you have no idea what wallet or format your wallet and/or private keys were being stored in, you effectively have no idea what you're looking for, so your chances of being able to identify anything recovered from that drive a pretty slim.

You're looking for an unknown object in a stack of (most likely corrupted) objects :-\

  Thanks for all the responses. I appreciate everyone taking the time to try and help me solve this.


  I do remember using the Mnemonic recovery at the time and I'm pretty sure now that I just used Blockchain to look up the public key.

  I don't think the mini notebook I had at the time could even hold the blockchain so as HCP said that eliminates Bitcoin Core and wallet.dat right?

  Were there a lot of desktop wallets available in 2011?

  Does anyone remember a more repsected/secure one at that time?

  Was the mnemonic (and possible the SMS verification) common at the time?

  So if I ever were to stumble across the Mnemonic I wrote down and the wallet provider is gone does it still recover my private keys?
 

Should most likely be blockchain.info then but their mnemonic phrase doesnt encode private keys unlike in BIP39 or Electrum but the (wallet identifier &) password.
If you have that phrase then you can enter it here (https://blockchain.info/wallet/forgot-password?guid=) to get your wallet identifier & password.
With the email address or identifier and password you should be able to access your wallet.
They also stored a backup file containing the private keys in an aes.json file, do you remember ever using that?

Stop using this computer because it overwrites all the data to the HDD again and send it for a recovery to the professionals. They may help you. But don't tell them about bitcoins. It's better not to know because they can take them if wallet is not protected with a password.

You might want to look at other wallets like electrum. I think the bitcoin website probably has old versions of other wallets avaliable. Electrum is an SPV wallet so it didn't need to download the blockchain (which is an obvious attraction).

I don't think the current (bip38/49) wallet seeds were around then. It's more likely an odd hash of ununderstandable alphanumeric master private keys.