Bitcoin Forum

I would like to use a hex editor to search my hard drive for a particular bitcoin address.  I know the bitcoin public address that I want to search.  I know that Bitcoin core uses the Berkeley DB format to store key pairs, but I can't seem to figure out how it works.  How do I "convert" a known public bitcoin address to the format that I would need to search my drive with a hex editor.  I hope my question makes sense.

Thanks!

Bitcoin Core does not store the address itself nor does it store the hash160 which is encoded by the address. Bitcoin Core stores the public key and its private key, but the address encodes the hash of the public key. You cannot compute the public key from the address, all you can really do is find public keys and compute their addresses to see if they match your address.

Luckily Bitcoin Core stores public keys in a fairly obvious form. They are prefixed with the letters "key" or "ckey" depending on whether your wallet is encrypted. Not that you cannot just search for these strings as there are other data in the wallet file that have the string "key" in them. Following the string will be a length prefix specifying 33 or 65 bytes and then the public key itself.

Thank you very much for your explanation. It seems that however much I learn, there are many more layers underneath to uncover!  That’s too bad for me that I can’t search for the address. I’ll search the interwebs for how to get the address from the public key. Thanks again!

A follow up question...I understand that if an address has a transaction, then the public key can then be known. That’s why bitcoin generally uses new addresses every time. How can I find the public key in the event that the address has a transaction?  The address I’m looking for does not, but I’m just asking to learn in this case.

You would have to find the transaction, parse it as a standard Bitcoin transaction, and look at the inputs to see if any of the public keys hash to the hash encoded by your address. Bitcoin Core does not store transactions by association to the address, and addresses nor their data are contained in the inputs of a transaction.

Note that transactions can also be associated by the outputs. In that case, the public key is not known, however the hash provided in the output will be the same hash encoded by the address.