Bitcoin Forum

Hello there,

   I have a dilemma! I remember buying Bitcoin at its infancy 2009/2010 however remember deleting the wallet and all related programs as the PC was running so slow and was crashing!!
got a new PC then and left the old (now none bootable) one untouched till recently when I downloaded some Deleted file recovery software to try to find the wallet or any sign of it!!

I am very primitive when it comes to computers do not know coding, Python or any other PC language just a simple Windows operator!

 Any bitcoin/blockchain specific identifying file, cookies, programs, scripts.... names to plug in to the recovery software search that would hint to existence of bitcoin/ wallet or blockchain on the old hard drives?
any Windows software that I can download/ buy to find/ recover them?
What do you recommend to see if it's worth going to the next step of professional recovery?? 

Thank you all.

Before you do anything else, i strongly recommend you to make RAW copy of your drive. There are few tools such as http://www.hddguru.com/software/HDD-Raw-Copy-Tool/ (http://www.hddguru.com/software/HDD-Raw-Copy-Tool/)

The only tools specific to search Bitcoin wallet i know is only https://bitcointalk.org/index.php?topic=5071775.msg48037878#msg48037878 (https://bitcointalk.org/index.php?topic=5071775.msg48037878#msg48037878), but that assuming you never delete your Bitcoin wallet.
If you think you deleted it as well, you should any file recover software to search file with name "wallet" &  "wallet.dat"

Additional to ETFbitcoin you can also try to make a clone disk if you have extra HDD or SSD you can use to make clone of your disk, OS and including files from your HDD.

Check this tutorial from here https://www.youtube.com/watch?v=3F2nh35jq58 including the free software.

For recovery, you can use Acronis revive it is one of the latest data recovery as of now but it is not free video you can check this video guide how it works from here https://www.youtube.com/watch?v=dtwTsxD_9wU

If you are looking for free tools to recover files you can try Recuva you can check the guide from Britec from here https://www.youtube.com/watch?v=dtwTsxD_9wU

Hello,

You should boot the computer from.a.USB drive and then run a tool called pywallet, it will go through your drive on sector level and find possible wallet files, encrypted keys or unencrypted keys, even if the files afe deleted.

You just need to install python and required libs.

pywallet could be find on github and its open source.

/KX

@OP,
If you decide to go through this suggestion, please beware about the risks here if you download it from an unofficial source  (https://amp.reddit.com/r/Bitcoin/comments/4e2bqy/warning_i_discovered_this_morning_that_the/)

Please use GitHub only for this -

https://github.com/pywallet/PyWallet?files=1

Bitcoin wallet importer/exporter by jackjack-jj (https://github.com/jackjack-jj/pywallet?files=1)

pywallet-win-files (probably Windows related files as they're in .bat format by jackjack-jj (https://github.com/jackjack-jj/pywallet-win-files?files=1)

Hope this helps you get back your BTC.

Thank you all for the advise, as I mentioned I am very primitive when it comes to computers do not know any coding, Python or any other PC language....
I've been watching u tube videos about node and java..... I think I'm way over my head here!!

will create a github account and try downloading/ running/ copy & past these files, hope I will run into something!

probably will either have to go to school to learn it or seek professional help!!

If I manage to use the Jackkack wallet ...  from GitHub, does it have to be ran from the same hard drive or can I scan multiple drives  connected  with USB?

How much time/ how much expertise would it take to properly run such a program?

Would someone be able to walk me through it or is it too complicated??

Hello

you should not install any software or run anything from the drive you try to recover as it overwrites data.

Boot from USB or external drive.

Personally I recommend you create an image of the drive before you start playing around as you might overwrite sensitive data
and have it as a backup.

And yes, you can scan multiple drives, but do them one by one. On average 500gb takes 5 houra to run.

/KX

Recovery attempts should never be done on the original drive.

From a forensic point of view, one should create 2 images (raw copies) and perform recovery on one of them.
Then after trying out a specific tool, a new raw copy should be created to try further recovery software on it.


One backup should always be kept safe and the original drive should never be touched with recovery software.


These are the basics of forensics.

all hard drives have been sector by sector cloned as a precaution a while ago, (great idea to have a just in case backup for the backup)  I just need to learn how to run the Jack Jack wallet script through all of them:-/ !!!

Did you manage to run it?

Depending on your os the settings are different.

If you specify os version and drive size (yes, drive size has to be included in the search) I could write out the parameters for you.

A typical drive (non ssd) takes about 5-8 hours for 250 gb

It prints out possible keys.

/KX

Unfortunately not even close, Still trying to learn Python/ coding basics to be able to run the jack jack wallet code,
as I mentioned I'm not a tech guy at all!!

Did you read the instructions on github (https://github.com/jackjack-jj/pywallet) ?

It says what dependencies you need to install and and the options you can start the script with.

You don't really need to code anything, just install the necessary files and start the script with the correct parameters.

What os are you planning to use for the recovery, i can write out a step by step as I've done this recently for a client in New York.

/KX

that's my problem my friend!!
I don't know what pip, dependencies, parameters, ......... are, or how they work, or even what they mean!!!
so slowly but surly downloading what I can, but someone told me I will have to rewrite the script to match where I downloaded the programs ( the path has to match) so I will have to redo (uninstall/ reinstall) all what I did so far or go through the script to reidentify the path where I have Python, twisted....

so far I'm at:
unexpected indent, there are packages available in the repositories of:file<stdin>, line1
and syntaxerror: invalid syntax Debian and Ubuntu as python-twisted for python2
again have no clue what that means but still trying.

I'm using windows, but guess just to verify the presence of the wallet I will have to use python to run the Jack Jack wallet script. then the recovery will be a whole different process.

is it real to recover your btc  it from 2009\2010?  :-\

Were you able to do the following without any errors ?



According to the 'syntax error', it seems python twisted is not installed yet ?

Could you outline what exactly you have installed already ?

If it is possible? Yes. Read the entire thread.
Depending on how much you have used your hard drive since you lost access to your bitcoins you might extract the needed information using the suggestions provided here.

But open a new thread and explain exactly what happened.

ooook, so the pip wasn't even installed so twisted was downloaded but not quit installed!
now I downloaded and ran pip
downloaded and ran twisted
in the process of downloading Microsoft Visual C++ Compiler for Python 2.7.
I think I'm almost there,  ;D
wish me luck.

so I'm down to only one error msg!
syntaxerror: invalid syntax
>>>C:\users\PCname\desktop\jackjack.js
file "<stdin>" line 1
hope to resolve this one last obstacle soon!!

BTW: A fellow from the community here offered to help me step by step, hope he can solve it with me.
Thanks in advance Avast12.

Where does the javascript file jackjack.js come from ?
And how do you call it ? Via double-click or command line ?

I hope you two get it fixed.

But do not share any sensitive information with anyone! Avast12 changed his password last week.
Doesn't have to mean something.. but better be safe than sorry.

I get this error when I drag and drop the Jackjack file into python!

If I copy and paste the script into python it takes a few seconds filling in all the lines then disappear/ close on its own!
 Reading the first few lines of the code it refers to python 2.2 I have 2.7, is this wrong? did I download the wrong one?
Avast12 insists on finding wallet.dat via recovery software, which I’ve been trying for a few month now on and off so that’s a no go!!
I thought jackjack bypass the wallet file and get to the keys, am I wrong?
Last question does Jackjack look into windows backup/ restore files as well??

But where did you get the file from ?
The .js extension means it is a javascript file. But pywallet is a python (.py file).




No, python 2.7 is correct.




Yes, you can give pywallet a drive to search for possible private keys.




It looks wherever you want it to look at. Usually you just give it a whole drive / partition as  parameter with the --recover and --recov_device parameter


Can you verify that you have downloaded pywallet.py from https://github.com/jackjack-jj/pywallet/blob/master/pywallet.py (https://github.com/jackjack-jj/pywallet/blob/master/pywallet.py) ?

yes it's downloaded, I didn't know that pip is the magic word for everything python!!
I met with someone Tuesday that helped me download ecdsa, and pycrypto however ran out of time at the bsddb3 ( Error: cannot find a version that satisfy the request) I tried as well with no luck however finally managed to install bsddb (without the 3)

now up against another long error has to do with sha256!  fatal error cannot open include file: stdint.h no such file or directory!!

our forum friend Avast12 suggests I enable windows optional feature online windows subsystem Linux however I can't do that either!!! :'( :'(
every time I feel so close I find out I'm so far!!
using windows makes us too spoiled/ dependent on the machine click= result.
a whole new found appreciation and respect to programmers and developers.

oh, thank you,
are these the files that may help with all the problems I'm having??

so i've been stuck at this for a week now!!

C:\Users\Hoss>pip install pywallet
DEPRECATION: Python 2.7 will reach the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 won't be maintained after that date. A future version of pip will drop support for Python 2.7. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
Collecting pywallet
Requirement already satisfied: six>=1.8.0 in c:\python27\lib\site-packages (from pywallet) (1.12.0)
Requirement already satisfied: pycryptodome>=3.6.6 in c:\python27\lib\site-packages (from pywallet) (3.8.2)
Collecting two1>=3.10.8 (from pywallet)
Requirement already satisfied: base58>=0.2.2 in c:\python27\lib\site-packages (from pywallet) (0.2.2)
Requirement already satisfied: ecdsa>=0.11 in c:\python27\lib\site-packages (from pywallet) (0.13.2)
Requirement already satisfied: pexpect in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (4.7.0)
Requirement already satisfied: pyyaml in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (5.1.1)
Requirement already satisfied: flake8 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (3.7.8)
Requirement already satisfied: jsonrpcserver==3.1.1 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (3.1.1)
Collecting sha256 (from two1>=3.10.8->pywallet)
  Using cached https://files.pythonhosted.org/packages/04/98/e2d70dc0af14a35ee62c5f6146120f8735e43e1de5daf633c61a2cdd8e67/sha256-0.1.tar.gz
Requirement already satisfied: pyaes in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (1.6.1)
Requirement already satisfied: arrow in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (0.14.4)
Requirement already satisfied: requests<=2.11.1 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (2.11.1)
Requirement already satisfied: pytest in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (4.6.4)
Requirement already satisfied: mnemonic==0.13 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (0.13)
Requirement already satisfied: path.py in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (11.5.2)
Collecting tabulate (from two1>=3.10.8->pywallet)
Requirement already satisfied: docker-py==1.8.0 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (1.8.0)
Requirement already satisfied: click==6.6 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (6.6)
Requirement already satisfied: jsonrpcclient==2.0.1 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (2.0.1)
Requirement already satisfied: protobuf==3.0.0a3 in c:\python27\lib\site-packages (from two1>=3.10.8->pywallet) (3.0.0a3)
Requirement already satisfied: ptyprocess>=0.5 in c:\python27\lib\site-packages (from pexpect->two1>=3.10.8->pywallet) (0.6.0)
Requirement already satisfied: entrypoints<0.4.0,>=0.3.0 in c:\python27\lib\site-packages (from flake8->two1>=3.10.8->pywallet) (0.3)
Requirement already satisfied: configparser; python_version < "3.2" in c:\users\hoss\appdata\roaming\python\python27\site-packages (from flake8->two1>=3.10.8->pywallet) (3.7.4)
Requirement already satisfied: pycodestyle<2.6.0,>=2.5.0 in c:\python27\lib\site-packages (from flake8->two1>=3.10.8->pywallet) (2.5.0)
Requirement already satisfied: functools32; python_version < "3.2" in c:\python27\lib\site-packages (from flake8->two1>=3.10.8->pywallet) (3.2.3.post2)
Requirement already satisfied: typing; python_version < "3.5" in c:\python27\lib\site-packages (from flake8->two1>=3.10.8->pywallet) (3.7.4)
Requirement already satisfied: enum34; python_version < "3.4" in c:\python27\lib\site-packages (from flake8->two1>=3.10.8->pywallet) (1.1.6)
Requirement already satisfied: pyflakes<2.2.0,>=2.1.0 in c:\python27\lib\site-packages (from flake8->two1>=3.10.8->pywallet) (2.1.1)
Requirement already satisfied: mccabe<0.7.0,>=0.6.0 in c:\users\hoss\appdata\roaming\python\python27\site-packages (from flake8->two1>=3.10.8->pywallet) (0.6.1)
Requirement already satisfied: funcsigs in c:\python27\lib\site-packages (from jsonrpcserver==3.1.1->two1>=3.10.8->pywallet) (1.0.2)
Requirement already satisfied: jsonschema in c:\python27\lib\site-packages (from jsonrpcserver==3.1.1->two1>=3.10.8->pywallet) (3.0.1)
Requirement already satisfied: backports.functools-lru-cache>=1.2.1; python_version == "2.7" in c:\users\hoss\appdata\roaming\python\python27\site-packages (from arrow->two1>=3.10.8->pywallet) (1.5)
Requirement already satisfied: python-dateutil in c:\python27\lib\site-packages (from arrow->two1>=3.10.8->pywallet) (2.8.0)
Requirement already satisfied: packaging in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (19.1)
Requirement already satisfied: importlib-metadata>=0.12 in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (0.19)
Requirement already satisfied: pluggy<1.0,>=0.12 in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (0.12.0)
Requirement already satisfied: attrs>=17.4.0 in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (19.1.0)
Requirement already satisfied: pathlib2>=2.2.0; python_version < "3.6" in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (2.3.4)
Requirement already satisfied: py>=1.5.0 in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (1.8.0)
Requirement already satisfied: atomicwrites>=1.0 in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (1.3.0)
Requirement already satisfied: wcwidth in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (0.1.7)
Requirement already satisfied: colorama; sys_platform == "win32" in c:\users\hoss\appdata\roaming\python\python27\site-packages (from pytest->two1>=3.10.8->pywallet) (0.4.1)
Requirement already satisfied: more-itertools<6.0.0,>=4.0.0; python_version <= "2.7" in c:\python27\lib\site-packages (from pytest->two1>=3.10.8->pywallet) (5.0.0)
Requirement already satisfied: pbkdf2 in c:\python27\lib\site-packages (from mnemonic==0.13->two1>=3.10.8->pywallet) (1.3)
Requirement already satisfied: py2-ipaddress>=3.4.1; python_version < "3" in c:\python27\lib\site-packages (from docker-py==1.8.0->two1>=3.10.8->pywallet) (3.4.1)
Requirement already satisfied: websocket-client>=0.32.0 in c:\python27\lib\site-packages (from docker-py==1.8.0->two1>=3.10.8->pywallet) (0.56.0)
Requirement already satisfied: future in c:\python27\lib\site-packages (from jsonrpcclient==2.0.1->two1>=3.10.8->pywallet) (0.17.1)
Requirement already satisfied: setuptools in c:\python27\lib\site-packages (from protobuf==3.0.0a3->two1>=3.10.8->pywallet) (40.6.2)
Requirement already satisfied: pyrsistent>=0.14.0 in c:\python27\lib\site-packages (from jsonschema->jsonrpcserver==3.1.1->two1>=3.10.8->pywallet) (0.15.4)
Requirement already satisfied: pyparsing>=2.0.2 in c:\python27\lib\site-packages (from packaging->pytest->two1>=3.10.8->pywallet) (2.4.1.1)
Requirement already satisfied: zipp>=0.5 in c:\python27\lib\site-packages (from importlib-metadata>=0.12->pytest->two1>=3.10.8->pywallet) (0.5.2)
Requirement already satisfied: contextlib2; python_version < "3" in c:\python27\lib\site-packages (from importlib-metadata>=0.12->pytest->two1>=3.10.8->pywallet) (0.5.5)
Requirement already satisfied: scandir; python_version < "3.5" in c:\python27\lib\site-packages (from pathlib2>=2.2.0; python_version < "3.6"->pytest->two1>=3.10.8->pywallet) (1.10.0)
Building wheels for collected packages: sha256
  Building wheel for sha256 (setup.py) ... error
  ERROR: Command errored out with exit status 1:
   command: 'c:\python27\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'c:\\users\\hoss\\appdata\\local\\temp\\pip-install-fib0vz\\sha256\\setup.py'"'"'; __file__='"'"'c:\\users\\hoss\\appdata\\local\\temp\\pip-install-fib0vz\\sha256\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' bdist_wheel -d 'c:\users\hoss\appdata\local\temp\pip-wheel-4nvfv1' --python-tag cp27
       cwd: c:\users\hoss\appdata\local\temp\pip-install-fib0vz\sha256\
  Complete output (11 lines):
  running bdist_wheel
  running build
  running build_ext
  building 'sha256' extension
  creating build
  creating build\temp.win-amd64-2.7
  creating build\temp.win-amd64-2.7\Release
  C:\Users\Hoss\AppData\Local\Programs\Common\Microsoft\Visual C++ for Python\9.0\VC\Bin\amd64\cl.exe /c /nologo /Ox /MD /W3 /GS- /DNDEBUG -Ic:\python27\include -Ic:\python27\PC /Tcsha256.c /Fobuild\temp.win-amd64-2.7\Release\sha256.obj
  sha256.c
  sha256.c(255) : fatal error C1083: Cannot open include file: 'stdint.h': No such file or directory
  error: command 'C:\\Users\\Hoss\\AppData\\Local\\Programs\\Common\\Microsoft\\Visual C++ for Python\\9.0\\VC\\Bin\\amd64\\cl.exe' failed with exit status 2
  ----------------------------------------
  ERROR: Failed building wheel for sha256
  Running setup.py clean for sha256
Failed to build sha256
Installing collected packages: sha256, tabulate, two1, pywallet
  Running setup.py install for sha256 ... error
    ERROR: Command errored out with exit status 1:
     command: 'c:\python27\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'c:\\users\\hoss\\appdata\\local\\temp\\pip-install-fib0vz\\sha256\\setup.py'"'"'; __file__='"'"'c:\\users\\hoss\\appdata\\local\\temp\\pip-install-fib0vz\\sha256\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'c:\users\hoss\appdata\local\temp\pip-record-5cremh\install-record.txt' --single-version-externally-managed --compile
         cwd: c:\users\hoss\appdata\local\temp\pip-install-fib0vz\sha256\
    Complete output (11 lines):
    running install
    running build
    running build_ext
    building 'sha256' extension
    creating build
    creating build\temp.win-amd64-2.7
    creating build\temp.win-amd64-2.7\Release
    C:\Users\Hoss\AppData\Local\Programs\Common\Microsoft\Visual C++ for Python\9.0\VC\Bin\amd64\cl.exe /c /nologo /Ox /MD /W3 /GS- /DNDEBUG -Ic:\python27\include -Ic:\python27\PC /Tcsha256.c /Fobuild\temp.win-amd64-2.7\Release\sha256.obj
    sha256.c
    sha256.c(255) : fatal error C1083: Cannot open include file: 'stdint.h': No such file or directory
    error: command 'C:\\Users\\Hoss\\AppData\\Local\\Programs\\Common\\Microsoft\\Visual C++ for Python\\9.0\\VC\\Bin\\amd64\\cl.exe' failed with exit status 2
    ----------------------------------------
ERROR: Command errored out with exit status 1: 'c:\python27\python.exe' -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'c:\\users\\hoss\\appdata\\local\\temp\\pip-install-fib0vz\\sha256\\setup.py'"'"'; __file__='"'"'c:\\users\\hoss\\appdata\\local\\temp\\pip-install-fib0vz\\sha256\\setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record 'c:\users\hoss\appdata\local\temp\pip-record-5cremh\install-record.txt' --single-version-externally-managed --compile Check the logs for full command output.



trying to install sha256 but don't know how!
don't know what else i should download/ do!!
help please???
Thank you all.

The failure seems to be on Visual C++, I would recommend a clean install, maybe create a VM or USB boot stick and start over. Its really simple to install above libs.

Why dont you get someone on here thats trusted to help you out via team viewer offer them a %.
I imagine if you bought it in its infancy you have a pretty good amount.
I only suggest this because you mentioned you where not very proficient and sometimes this stuff can be complicated on windows.
Be careful who you pick to help on this.

What is team viewer?? This sounds intriguing 🤔

BTW I didn’t say not proficient!! I totally don’t know anything about python, thought I can manage to install/run the program on my own, when/ if I find the coins then I certainly would give someone a sizable thank you gift/ token of appreciation for the actual recovery to use in a new wallet.

""I am very primitive when it comes to computers do not know coding, Python or any other PC language just a simple Windows operator!""

I dont know how I was supposed to interpret that and my apologies,
Team viewer is a remote access gui based tool that agreed upon parties can gain access to your system while you watch them work/configure/fix.
It looks a lot like a ghost is using your computer when its in use.

If you find a private key that way, the person with remote access will instantly see your private key on his screen. Be very careful who you trust!

I would like to add that LoyceV would be a great option to help you out. Loyce if you get a piece of the pie shoot me a crumb :P
Im not remoting with "anyone" i have trust issues.

I second that and say it again BE CAREFULL! maybe consult here about who your trusting with said task first.

I would if I could, but I have no experience with either pywallet or team viewer.

Maybe try using the .exe installer for Pywallet... as per the instructions here: https://bitcointalk.org/index.php?topic=34028.0
NOTE: do not bother with the .bat file and using the web interface... it's no good for what you want.

That should install all the bits and pieces that you need to have pywallet.py installed somewhere on your system... you should then be able to use "python pywallet.py [blah blah blah]" as required. I have successfully used this installer on Windows 10 to setup pywallet.

Note, the installer is in French... so here are some screenshots with notes:
https://talkimg.com/images/2023/11/15/z7FLP.png

You should see a cmd window like this popup:
https://talkimg.com/images/2023/11/15/z7Neq.png

Then you should see WGET start:
https://talkimg.com/images/2023/11/15/z7IGj.png

Now you can click "Next", "Next", "Next".... "Install", then "Finish". You'll see a bunch more commands in the commandline box and then it should close.

Now open the commandline to the install directory that you put in Step 1. above and run "install.bat"... you'll see a bunch of commandsline execute and then you will see pywallet.py in the "dir" listing:
https://talkimg.com/images/2023/11/15/z7syG.png

Following that, you should be able to run pywallet.py... you can safely ignore the warning about pycrypto and libssl...
https://talkimg.com/images/2023/11/15/z73KD.png


If you are still getting errors about modules/libraries OTHER than pycrypto or libssl, then there is a good chance that you have not installed Python 2.7 correctly (or perhaps your %PATH% is not set correctly).

Funny i installed this on Monday:

HTTP request sent, awaiting response... 200 OK
Length: 780 [text/plain]
Saving to: `update.bat'

100%[==============================================================================>] 780         --.-K/s   in 0s

2019-08-12 15:35:32 (86.3 MB/s) - `update.bat' saved [780/780]


C:\Users\Hoss>update.bat

C:\Users\Hoss>if AMD64 == x86 set arch=

C:\Users\Hoss>if AMD64 == AMD64 set arch= (x86)

C:\Users\Hoss>if AMD64 == IA64 set arch= (x86)

C:\Users\Hoss>del pywallet.py
Could Not Find C:\Users\Hoss\pywallet.py

C:\Users\Hoss>"C:\Program Files (x86)\GnuWin32\bin\wget.exe" https://raw.github.com/jackjack-jj/pywallet/master/pywallet.py --no-check-certificate
SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc
syswgetrc = C:\Program Files (x86)\GnuWin32/etc/wgetrc
--2019-08-12 15:35:32--  https://raw.github.com/jackjack-jj/pywallet/master/pywallet.py
Resolving raw.github.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.github.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.github.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.github.com'.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://raw.githubusercontent.com/jackjack-jj/pywallet/master/pywallet.py [following]
--2019-08-12 15:35:32--  https://raw.githubusercontent.com/jackjack-jj/pywallet/master/pywallet.py
Resolving raw.githubusercontent.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.githubusercontent.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.githubusercontent.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.githubusercontent.com'.
HTTP request sent, awaiting response... 200 OK
Length: 345092 (337K) [text/plain]
Saving to: `pywallet.py'

100%[==============================================================================>] 345,092     --.-K/s   in 0.07s

2019-08-12 15:35:32 (4.98 MB/s) - `pywallet.py' saved [345092/345092]


C:\Users\Hoss>del pywallet.bat
Could Not Find C:\Users\Hoss\pywallet.bat

C:\Users\Hoss>"C:\Program Files (x86)\GnuWin32\bin\wget.exe" https://raw.github.com/jackjack-jj/pywallet-win-files/master/pywallet.bat --no-check-certificate
SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc
syswgetrc = C:\Program Files (x86)\GnuWin32/etc/wgetrc
--2019-08-12 15:35:32--  https://raw.github.com/jackjack-jj/pywallet-win-files/master/pywallet.bat
Resolving raw.github.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.github.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.github.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.github.com'.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://raw.githubusercontent.com/jackjack-jj/pywallet-win-files/master/pywallet.bat [following]
--2019-08-12 15:35:33--  https://raw.githubusercontent.com/jackjack-jj/pywallet-win-files/master/pywallet.bat
Resolving raw.githubusercontent.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.githubusercontent.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.githubusercontent.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.githubusercontent.com'.
HTTP request sent, awaiting response... 200 OK
Length: 32 [text/plain]
Saving to: `pywallet.bat'

100%[==============================================================================>] 32          --.-K/s   in 0s

2019-08-12 15:35:33 (3.91 MB/s) - `pywallet.bat' saved [32/32]


C:\Users\Hoss>del install.bat
Could Not Find C:\Users\Hoss\install.bat

C:\Users\Hoss>"C:\Program Files (x86)\GnuWin32\bin\wget.exe" https://raw.github.com/jackjack-jj/pywallet-win-files/master/install.bat --no-check-certificate
SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc
syswgetrc = C:\Program Files (x86)\GnuWin32/etc/wgetrc
--2019-08-12 15:35:33--  https://raw.github.com/jackjack-jj/pywallet-win-files/master/install.bat
Resolving raw.github.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.github.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.github.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.github.com'.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://raw.githubusercontent.com/jackjack-jj/pywallet-win-files/master/install.bat [following]
--2019-08-12 15:35:33--  https://raw.githubusercontent.com/jackjack-jj/pywallet-win-files/master/install.bat
Resolving raw.githubusercontent.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.githubusercontent.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.githubusercontent.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.githubusercontent.com'.
HTTP request sent, awaiting response... 200 OK
Length: 1943 (1.9K) [text/plain]
Saving to: `install.bat'

100%[==============================================================================>] 1,943       --.-K/s   in 0.001s

2019-08-12 15:35:33 (3.26 MB/s) - `install.bat' saved [1943/1943]


C:\Users\Hoss>del update.bat   & "C:\Program Files (x86)\GnuWin32\bin\wget.exe" https://raw.github.com/jackjack-jj/pywallet-win-files/master/update.bat --no-check-certificate
SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc
syswgetrc = C:\Program Files (x86)\GnuWin32/etc/wgetrc
--2019-08-12 15:35:33--  https://raw.github.com/jackjack-jj/pywallet-win-files/master/update.bat
Resolving raw.github.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.github.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.github.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.github.com'.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://raw.githubusercontent.com/jackjack-jj/pywallet-win-files/master/update.bat [following]
--2019-08-12 15:35:34--  https://raw.githubusercontent.com/jackjack-jj/pywallet-win-files/master/update.bat
Resolving raw.githubusercontent.com... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.githubusercontent.com|151.101.0.133|:443... connected.
WARNING: cannot verify raw.githubusercontent.com's certificate, issued by `/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA':
  Unable to locally verify the issuer's authority.
WARNING: certificate common name `www.github.com' doesn't match requested host name `raw.githubusercontent.com'.
HTTP request sent, awaiting response... 200 OK
Length: 780 [text/plain]
Saving to: `update.bat'

100%[==============================================================================>] 780         --.-K/s   in 0s

2019-08-12 15:35:34 (95.4 MB/s) - `update.bat' saved [780/780]


C:\Users\Hoss>C:\Users\Hoss\Documents\pywallet-win-files-master\pywallet.bat

C:\Users\Hoss>pywallet.py --web --port 8989
2019-08-12 15:36:24-0700 [-] Log opened.
2019-08-12 15:36:24-0700 [-] Starting server: 2019-08-12 15:36:24.787000
2019-08-12 15:36:24-0700 [-] Site starting on 8989
2019-08-12 15:36:24-0700 [-] Starting factory <twisted.web.server.Site instance at 0x0000000004F993C8>



C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --web --port 8989
2019-08-12 16:00:19-0700 [-] Log opened.
2019-08-12 16:00:19-0700 [-] Starting server: 2019-08-12 16:00:19.899000
2019-08-12 16:00:19-0700 [-] Site starting on 8989
2019-08-12 16:00:19-0700 [-] Starting factory <twisted.web.server.Site instance at 0x0000000004ADD6C8>


exactly what u said happened, I tried to open port 8989 (didn't know how) on internet explorer but didn't work!!


tried pip install pywallet and the same error msg.!

ran it again today and opened port 8989 on chrome and voila, it's on: pywallet 2.2

now i just have to learn how to use it, change search directories to external drives to find deleted or hidden wallets, keys, passwords, locations........
thank you very much.

HMM,

  so while testing the PYwallet2.2 program: when I run the import a read-only address in the info tab I get this address:

 1HT7xU2Ngenf7D4yocz2SAcnNLW7rK8d4E

which seems to be around for years: https://bitcointalk.org/index.php?topic=1225430.msg12811008#msg12811008
when I run the key in the info tab get some info about one key I get the private key, hexprivkey, hash160, Pubkey aswell!!!
when I run it in print balance: it gets the exact balance off the blockchain!

I never downloaded this key to this computer, and don't even have a wallet here yet!!

I still need to learn how to make pywallet2.2 look else where beside the c:\ drive totally offline!!

I suggest you read some of the later posts (like the last 2 or 3 pages) in this thread: https://bitcointalk.org/index.php?topic=34028.640

As already mentioned, DON'T use the web interface. You need to use the commandline.

There are plenty examples of how to use PyWallet in "--recover" mode. The general format is:


Note that it uses "Gio" instead of GB for the size of the device to scan... and for anything larger than a USB stick of 4-8Gigs, you can expect to be waiting for hours and hours for the scan to finish. Scanning a full harddrive of several hundred gigs will likely take over a day.

Thank you Legendary HCP, I will certainly read ( the whole 33 pages) as I need to learn as much as I can, and screw up the least :-)

if you don't mind me asking why not use the web interface? is it complicated to use, not reliable, not secure, not as accurate?

when I run/ open the pywallet2.2 window I see all the commands I click on autowritten on the CMD aswell, ( I think).

the plan is once I have the software set up and running ( without the need to download/ update any more files) that PC will be permanently off line and searching for the wallet on an external drive for security reasons.

BTW, What do you think of this other tool:

https://bitcointalk.org/index.php?topic=25091.msg702133#msg702133

is it safe, easy, accurate?
Thanks again,

I'm currently compiling a list of all the possibly needed CMD commands to try them out (on a flash drive/ dummy HDD) in case I need any plugins, more pkg downloads before plugging in the old hard drive and going offline with the PC.

any tutorial  source/ how to videos (beside the readme file) with all these commands, and how to properly use them?

seems that what I found so far is targeting wallet.dat assuming I have it/ know where it is located on the HDD, but if it was deleted then what directory should I have pywallet look into?

and what file name ( if it doesn't exist anymore!!) with what commands?

intriguing to find the program looking for a hex format that's unique to bitcoin wallets however knowing how to make it work safely is a bit tricky!!

still slowly but surely a learning curve, but very exciting.

Pywallet doesn't look into directories in "recover" mode... it simply scans the entire device.

There really isn't a lot to learn if you're just wanting to scan a drive looking for potential/deleted wallet files. You simply use the options as already mentioned.

# --recover option tells pywallet to operate in recovery mode (ie. scan the device looking for wallet files)
# --recov_size options specifies the size of the device... if you have a 256gig drive, you say 256Gio... if it is an 8Gig thumbdrive, specify 8Gio (the script author used Gio for Gigabytes for some reason?) Note that if you have an 8Gig drive and specify a smaller size (ie. 2Gio), the script will only scan the first 2 gigs then stop.
# --recov_device specifies the drive letter for the device you want to scan
# --recov_outputdir simply tells the script where to place any "recovered" wallet files etc.

I don't recommend the browser interface as it will slow things down considerably for drive scanning. Also, it isn't terribly stable, is horribly outdated and may cause more issues than it solves. By using the commandline you can see exactly what the script is doing rather than having it filtered through the browser interface and other unnecessary packages.

Great, Thanks a lot for your patience and valuable advice, got it and no more web interface!

however when I tried the very clear much wanted and appreciated "idiot guide"

I got the following results:
C:\Users\Hoss>pywallet.py --recover
You must provide the device, the number of bytes to read and the output directory

C:\Users\Hoss>pywallet.py --recov_size=500.0Gio
A mandatory option is missing

Usage: pywallet.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  --passphrase=PASSPHRASE
                        passphrase for the encrypted wallet
  --dumpwallet          dump wallet in json format
  --dumpwithbalance     includes balance of each address in the json dump,
                        takes about 2 minutes per 100 addresses
  --importprivkey=KEY   import private key from vanitygen

C:\Users\Hoss>pywallet.py --recov_device C:\
A mandatory option is missing

Usage: pywallet.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  --passphrase=PASSPHRASE
                        passphrase for the encrypted wallet
  --dumpwallet          dump wallet in json format
  --dumpwithbalance     includes balance of each address in the json dump,
                        takes about 2 minutes per 100 addresses
  --importprivkey=KEY   import private key from vanitygen
  --importhex           KEY is in hexadecimal format
  --datadir=DATADIR     wallet directory (defaults to bitcoin default)
  --wallet=WALLETFILE   wallet filename (defaults to wallet.dat)
  --label=LABEL         label shown in the adress book (defaults to '')
  --testnet             use testnet subdirectory and address type
  --namecoin            use namecoin address type
  --otherversion=OTHERVERSION
                        use other network address type, whose version is
                        OTHERVERSION
  --info                display pubkey, privkey (both depending on the
                        network) and hexkey
  --reserve             import as a reserve key, i.e. it won't show in the
                        adress book
  --multidelete=MULTIDELETE
                        deletes data in your wallet, according to the file
                        provided
  --balance=KEY_BALANCE
                        prints balance of KEY_BALANCE
  --web                 run pywallet web interface
  --port=PORT           port of web interface (defaults to 8989)
  --recover             recover your deleted keys, use with recov_size and
                        recov_device
  --recov_device=RECOV_DEVICE
                        device to read (e.g. /dev/sda1 or E: or a file)
  --recov_size=RECOV_SIZE
                        number of bytes to read (e.g. 20Mo or 50Gio)
  --recov_outputdir=RECOV_OUTPUTDIR
                        output directory where the recovered wallet will be
                        put
  --clone_watchonly_from=CLONE_WATCHONLY_FROM
                        path of the original wallet
  --clone_watchonly_to=CLONE_WATCHONLY_TO
                        path of the resulting watch-only wallet
  --dont_check_walletversion
                        don't check if wallet version > 81000 before running
                        (WARNING: this may break your wallet, be sure you know
                        what you do)
  --wait=NSECONDS       wait NSECONDS seconds before launch



C:\Users\Hoss>pywallet.py --importprivkey=KEY
Traceback (most recent call last):
  File "C:\Users\Hoss\pywallet.py", line 5004, in <module>
    db_env = create_env(db_dir)
  File "C:\Users\Hoss\pywallet.py", line 1269, in create_env
    r = db_env.open(db_dir, (DB_CREATE|DB_INIT_LOCK|DB_INIT_LOG|DB_INIT_MPOOL|DB_INIT_TXN|DB_THREAD|DB_RECOVER))
bsddb.db.DBNoSuchFileError: (2, 'No such file or directory -- C:\\Users\\Hoss\\AppData\\Roaming\\Bitcoin\\__db.001: No such
 file or directory')


C:\Users\Hoss>pywallet.py --info
A mandatory option is missing

Usage: pywallet.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  --passphrase=PASSPHRASE
                        passphrase for the encrypted wallet
  --dumpwallet          dump wallet in json format
  --dumpwithbalance     includes balance of each address in the json dump,
                        takes about 2 minutes per 100 addresses


C:\Users\Hoss>pywallet.py --dumpwallet
Traceback (most recent call last):
  File "C:\Users\Hoss\pywallet.py", line 5004, in <module>
    db_env = create_env(db_dir)
  File "C:\Users\Hoss\pywallet.py", line 1269, in create_env
    r = db_env.open(db_dir, (DB_CREATE|DB_INIT_LOCK|DB_INIT_LOG|DB_INIT_MPOOL|DB_INIT_TXN|DB_THREAD|DB_RECOVER))
bsddb.db.DBNoSuchFileError: (2, 'No such file or directory -- C:\\Users\\Hoss\\AppData\\Roaming\\Bitcoin\\__db.001: No such file or directory')

C:\Users\Hoss>



C:\Users\Hoss>pywallet.py --importhex
A mandatory option is missing

Usage: pywallet.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  --passphrase=PASSPHRASE
                        passphrase for the encrypted wallet
  --dumpwallet          dump wallet in json format
  --dumpwithbalance     includes balance of each address in the json dump,



The only command that properly worked was:

C:\Users\Hoss>pywallet.py --version
pywallet.py 1.1


am I missing something or doing something terribly wrong??
do I have to create a file (with defined path) for potentially recovered wallet/ keys before running it?
So sorry, I'm normally not as stupid as I appear here however it's all very new to me!!!
Thanks again,

It looks like you are basically there and looks like pywallet is installed.

you arent giving all the required arguments for pywallet to actually do anything though.

You need to do a command like what has been posted by HCP:

python pywallet.py --recover --recov_size=XXX.XGio --recov_device X:\ --recov_outputdir X:\Where\to\put\found\stuff

as an example:

python pywallet.py --recover --recov_size=250Gio --recov_device F:\ --recov_outputdir C:\recoveredwallets

you will need to change 250 and F to the size of the drive you are scanning and the letter the drive shows up in my computer as.

As already said, make sure you take a back up first of the drive.

Also you will probably need to run command prompt as admin

Ohh, all this is one command??
Sorry I thought they were multiple different commands serving multiple different purposes!!!
Will try the one big line, and how about the destination file? I will have to create that ahead as well right?

No, the file will be created automatically. You have to specify where it is supposed to be created (--recov_outputdir parameter). Don't forget to modify all of the parameters.

You can either try to leave it blank or set it to something that you will remember (there is no need to use an external website for that). If I were you, I would set the passphrase just to be sure it worked fine. You will need it to open the wallet if the recovery turns out to be successful.

so I put in a pass phrase to start the program, it asked to input possible passphrase for the deleted wallet, pushed enter to skip ( as I have no recollection), it said starting recovery and immediately: can't open \\.\c:\, check the path or try as root Error:(2, 'no such file or directory')
I tried again but searching a USB Changed the command to search device D and got:  can't open \\.\D:\, check the path or try as root Error:(13, 'Permission denied')
 

So which drive is the one you want to scan? C or D? If D then running the command prompt as administrator should do the trick (simply right-click and select 'Run as administrator').

I want to run it on many drives none off which are connected yet!

so running it as an admin. CMD changes to: C:WINDOWS\system32>

then running the command gives me: python can't open file 'pywallet.py' : [Errno 2] no such file or directory

You need to navigate into the folder containing the file first, using cd.

For example, enter the following to get into the root directory:

Then navigate into the folder containing the script, for example:

Then start the script again. But obviously after connecting the drive.

That's beucase the 'pywallet.py' is located somewhere else. I found its location on the previous page of this thread. Type in the following command.


Now, try to run the recovery command, but make sure to select the correct drive.

so did that, it switched my commands in both user and admin to C:\Users\Hoss\Documents\pywallet-win-files-master>
when I type the command:
C:\Users\Hoss\Documents\pywallet-win-files-master>python pywallet.py --recover --recov_size=XXX.XGio --recov_device X:\ --recov_outputdir X:\Where\to\put\found\stuff  ( filling in the drive, size and output location)
it asks for passphrase for the new wallet, then possible pass phrase for lost wallet ( I just click enter to skip it)

still get the same msgs!!
can't open \\.\c:\, check the path or try as root Error:(2, 'no such file or directory')

then tried the flash drive "D" switched parameters and got the same msg:  can't open \\.\D:\, check the path or try as root Error:(13, 'Permission denied')

are there extra \\.\ in the program itself that makes it unrecognizable/inaccessible?

I tried to create a directory in the sys properties, environment variables as in: https://superuser.com/questions/143119/how-do-i-add-python-to-the-windows-path
python 27 was already in so I added python.exe
will try again.

Could you post the actual command you are trying to use?

If i remember rightly you have to use unix style paths so '/'s instead of '\', even when using it in windows. So both --recov_device and --recov_outputdir would need to be '/'s not '\'s.

C:\Users\Hoss\Documents\pywallet-win-files-master>python pywallet.py --recover --recov_size=XXX.XGio --recov_device X:/ --recov_outputdir X:/Where/to/put/found/stuff

so in the script it's self:   https://github.com/jackjack-jj/pywallet/blob/master/pywallet.py
line 4851:

4850       if len(device) in [2,3] and device[1]==':':
4851          device="\\\\.\\"+device

is this normal? are the \\\\.\\ out of place and confusing the program???

I have another copy of pywallet and the same command is on line 4778


here are the commands: ( PS** the passphrase is made up, wont be used ever after this operation)

Microsoft Windows [Version 10.0.17134.950]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\Hoss>pywallet.py --recover --recov_device C:\ --recov_size=465.0Gio --recov_outputdir C:\Users\Hoss\Desktop\found wallet
Enter the passphrase for the wallet that will contain all the recovered keys: push costa surge wrote soil hospital derived migrate vacation arts fremont analyzed

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
Can't open \\.\C:\, check the path or try as root
  Error: (2, 'No such file or directory')

C:\Users\Hoss>pywallet.py --recover --recov_device D:\ --recov_size=32.0Gio --recov_outputdir C:\Users\Hoss\Desktop\found wallet
Enter the passphrase for the wallet that will contain all the recovered keys: push costa surge wrote soil hospital derived migrate vacation arts fremont analyzed

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
Can't open \\.\D:\, check the path or try as root
  Error: (13, 'Permission denied')


when I change the directory as advised earlier same error but with only one proper (\) :


C:\Users\Hoss>cd C:\hoss\documents\pywallet-win-files-master
The system cannot find the path specified.

C:\Users\Hoss> cd C:\users\hoss\documents\pywallet-win-files-master

C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device D:\ --recov_size=32.0Gio --recov_outputdir C:\Users\Hoss\Desktop\found wallet
Enter the passphrase for the wallet that will contain all the recovered keys: push costa surge wrote soil hospital derived migrate vacation arts fremont analyzed

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
Can't open D:\, check the path or try as root
  Error: (13, 'Permission denied')

C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device C:\ --recov_size=465.0Gio --recov_outputdir C:\Users\Hoss\Desktop\found wallet
Enter the passphrase for the wallet that will contain all the recovered keys: push costa surge wrote soil hospital derived migrate vacation arts fremont analyzed

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
Can't open C:\, check the path or try as root
  Error: (2, 'No such file or directory')

C:\Users\Hoss\Documents\pywallet-win-files-master>

Yeah... it's just the stupid complicated thing you need to do when "escaping" special characters in programming languages! ::) You can ignore all this "gobbledy gook"... it's correct.



NOTE: It appears you are confusing a wallet encryption password (aka the "passphrase" that pywallet is prompting you to enter)... for a 12 word mnemonic recovery phrase. Bitcoin Core has never used 12 word mnemonic phrases. What pywallet is asking you for when it says "Enter the passphrase for the wallet that will contain all the recovered keys" is simply a "password" that will be used to encrypt the wallet.dat file that it is going to create... this can be anything you like, like abc123 or password123 etc... but you need to be able to remember it, because if pywallet is successful in finding private keys... then to use the wallet.dat within Bitcoin Core to recover your coins (or to extract the private keys from it) you will need the password! ;)



Anyway... onto the root cause of your current issue...
I apologise, I think I originally set you wrong with the device naming... DO NOT use the "\" char... so when you specify --recov_device, it should simply be C: or D: or X: or whatever

If you include the \ character, then the script will get confused and give you the "Can't open C:\, check the path or try as root" type error. Sorry!

Anyway, based on what you have so your command should be:



NOTE: I would recommend that you don't use spaces in directory names... that could cause unexpected results. Also, you need to make sure that the output directory that you specify exists BEFORE you run the pywallet scan... otherwise it will fail at the end with an error like this:
https://talkimg.com/images/2023/11/15/z7Gfg.png

You are right, when It said passphrase I assumed it's the 12 words, my bad!

 I changed the Potential recovery folder name to avoid conflict ( no space now)

Changed the directory and commands with the following similar results: ( it now said permission denied instead of Error: (2, 'No such file or directory) now it's Can't open C:, check the path or try as root
  Error: (13, 'Permission denied')

Then displayed the Path and directory to see where the conflict may be coming from ( probably user error wrong download or install......).



C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device C: --recov_size=465.0Gio --recov_outputdir C:\Users\Hoss\Desktop\found_wallet
Enter the passphrase for the wallet that will contain all the recovered keys: 123

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
Can't open C:, check the path or try as root
  Error: (13, 'Permission denied')

C:\Users\Hoss\Documents\pywallet-win-files-master>path
PATH=C:\Python27\;C:\Python27\Scripts;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files\nodejs\;C:\ProgramData\chocolatey\bin;;C:\Program Files (x86)\AOMEI Backupper;C:\Users\Hoss\AppData\Local\Microsoft\WindowsApps;C:\Users\Hoss\AppData\Roaming\npm;C:\Users\Hoss\AppData\Local\Programs\Microsoft VS Code\bin

C:\Users\Hoss\Documents\pywallet-win-files-master>dir
 Volume in drive C has no label.
 Volume Serial Number is D6FD-F2FA

 Directory of C:\Users\Hoss\Documents\pywallet-win-files-master

08/23/2019  01:23 PM    <DIR>          .
08/23/2019  01:23 PM    <DIR>          ..
08/12/2019  05:23 PM             1,943 install.bat
08/21/2019  12:51 PM                 0 python
08/12/2019  05:23 PM                32 pywallet.bat
08/23/2019  10:32 AM           345,085 pywallet.py
08/23/2019  01:26 PM                 0 wallet.txt
               5 File(s)        347,060 bytes
               2 Dir(s)  454,830,444,544 bytes free


Microsoft Windows [Version 10.0.17134.950]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\Hoss>path
PATH=C:\Python27\;C:\Python27\Scripts;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files\nodejs\;C:\ProgramData\chocolatey\bin;;C:\Program Files (x86)\AOMEI Backupper;C:\Users\Hoss\AppData\Local\Microsoft\WindowsApps;C:\Users\Hoss\AppData\Roaming\npm;C:\Users\Hoss\AppData\Local\Programs\Microsoft VS Code\bin

C:\Users\Hoss>dir
 Volume in drive C has no label.
 Volume Serial Number is D6FD-F2FA

 Directory of C:\Users\Hoss

08/23/2019  12:21 PM    <DIR>          .
08/23/2019  12:21 PM    <DIR>          ..
07/08/2019  07:56 AM    <DIR>          .config
08/05/2019  02:38 PM    <DIR>          .idlerc
07/29/2019  11:59 AM               810 .node_repl_history
08/23/2019  10:32 AM    <DIR>          .pylint.d
07/08/2019  07:53 AM    <DIR>          .vscode
07/29/2019  01:23 PM                 0 1
07/31/2019  11:52 AM                83 2.14.2
08/14/2019  05:32 PM    <DIR>          3D Objects
07/31/2019  11:37 AM            39,064 arrow-0.14.4-py2.py3-none-any.whl
08/12/2019  05:47 PM            39,081 arrow-0.14.5-py2.py3-none-any.whl
07/31/2019  11:37 AM             5,885 atomicwrites-1.3.0-py2.py3-none-any.whl
07/31/2019  11:37 AM            35,784 attrs-19.1.0-py2.py3-none-any.whl
07/31/2019  11:37 AM             7,007 backports.functools_lru_cache-1.5-py2.py3-none-any.whl
07/31/2019  11:37 AM             3,072 base58-1.0.3-py2-none-any.whl
08/01/2019  08:50 AM           157,119 certifi-2019.6.16-py2.py3-none-any.whl
08/01/2019  08:50 AM           133,356 chardet-3.0.4-py2.py3-none-any.whl
07/31/2019  11:37 AM            71,011 click-6.6-py2.py3-none-any.whl
07/31/2019  11:37 AM            15,471 colorama-0.4.1-py2.py3-none-any.whl
07/31/2019  11:37 AM            22,494 configparser-3.7.4-py2.py3-none-any.whl
08/12/2019  05:47 PM            22,879 configparser-3.8.1-py2.py3-none-any.whl
08/14/2019  05:32 PM    <DIR>          Contacts
07/31/2019  11:37 AM             8,134 contextlib2-0.5.5-py2.py3-none-any.whl
08/08/2019  03:18 PM            16,518 dependencies-0.15-py2-none-any.whl
08/24/2019  09:40 PM    <DIR>          Desktop
08/14/2019  08:33 AM             2,386 dir
07/31/2019  11:37 AM            41,001 docker_py-1.8.0-py2.py3-none-any.whl
08/23/2019  11:26 AM    <DIR>          Documents
08/24/2019  10:05 PM    <DIR>          Downloads
07/31/2019  11:37 AM            59,060 ecdsa-0.13.2-py2.py3-none-any.whl
07/31/2019  11:37 AM            11,100 entrypoints-0.3-py2.py3-none-any.whl
07/31/2019  11:37 AM            12,427 enum34-1.1.6-py2-none-any.whl
08/14/2019  05:32 PM    <DIR>          Favorites
07/31/2019  11:37 AM            70,112 flake8-3.7.8-py2.py3-none-any.whl
07/31/2019  11:37 AM            17,697 funcsigs-1.0.2-py2.py3-none-any.whl
07/31/2019  11:37 AM            31,171 functools32-3.2.3-2.tar.gz
08/07/2019  08:07 AM            14,569 functools32-3.2.3.post2-cp27-none-any.whl
08/07/2019  08:07 AM           500,272 future-0.17.1-cp27-none-any.whl
07/31/2019  11:37 AM           829,119 future-0.17.1.tar.gz
08/07/2019  09:47 AM            42,313 hashlib-20081119.zip
08/01/2019  08:50 AM            58,594 idna-2.8-py2.py3-none-any.whl
07/31/2019  11:37 AM            26,442 importlib_metadata-0.19-py2.py3-none-any.whl
08/12/2019  04:10 PM             1,943 install.bat
08/07/2019  08:07 AM             8,130 jsonrpcclient-2.0.1-cp27-none-any.whl
07/31/2019  11:37 AM             6,427 jsonrpcclient-2.0.1.tar.gz
08/07/2019  08:07 AM            11,632 jsonrpcserver-3.1.1-cp27-none-any.whl
07/31/2019  11:37 AM             9,546 jsonrpcserver-3.1.1.tar.gz
07/31/2019  11:37 AM            54,363 jsonschema-3.0.1-py2.py3-none-any.whl
08/02/2019  12:43 PM            54,691 jsonschema-3.0.2-py2.py3-none-any.whl
08/14/2019  05:32 PM    <DIR>          Links
07/31/2019  11:37 AM             8,556 mccabe-0.6.1-py2.py3-none-any.whl
08/07/2019  08:07 AM            21,660 mnemonic-0.13-cp27-none-any.whl
07/31/2019  11:37 AM            21,683 mnemonic-0.13.tar.gz
07/31/2019  11:37 AM            52,303 more_itertools-5.0.0-py2-none-any.whl
08/14/2019  05:32 PM    <DIR>          Music
08/07/2019  06:15 AM    <DIR>          OneDrive
08/08/2019  05:40 PM            13,575 package-0.1.1.tar.gz
07/31/2019  11:37 AM            30,126 packaging-19.1-py2.py3-none-any.whl
07/31/2019  11:37 AM            19,439 path.py-11.5.2-py2.py3-none-any.whl
07/31/2019  11:37 AM            18,182 pathlib2-2.3.4-py2.py3-none-any.whl
08/07/2019  08:07 AM             5,118 pbkdf2-1.3-cp27-none-any.whl
07/31/2019  11:37 AM             6,360 pbkdf2-1.3.tar.gz
07/31/2019  11:37 AM            58,436 pexpect-4.7.0-py2.py3-none-any.whl
08/14/2019  05:32 PM    <DIR>          Pictures
07/31/2019  11:37 AM            17,926 pluggy-0.12.0-py2.py3-none-any.whl
08/07/2019  08:07 AM           114,484 protobuf-3.0.0a3-cp27-none-any.whl
07/31/2019  11:37 AM            88,399 protobuf-3.0.0a3.tar.gz
07/31/2019  11:37 AM            39,728 ptyprocess-0.6.0-py2.py3-none-any.whl
07/31/2019  11:37 AM            83,743 py-1.8.0-py2.py3-none-any.whl
07/31/2019  11:37 AM            17,880 py2-ipaddress-3.4.1.tar.gz
08/07/2019  08:07 AM            17,056 py2_ipaddress-3.4.1-cp27-none-any.whl
08/07/2019  08:07 AM            26,366 pyaes-1.6.1-cp27-none-any.whl
07/31/2019  11:37 AM            28,536 pyaes-1.6.1.tar.gz
07/31/2019  11:37 AM            51,191 pycodestyle-2.5.0-py2.py3-none-any.whl
07/31/2019  11:37 AM         9,969,666 pycryptodome-3.8.2-cp27-cp27m-win_amd64.whl
07/31/2019  11:37 AM            59,991 pyflakes-2.1.1-py2.py3-none-any.whl
08/05/2019  09:27 AM            38,175 pyPA-1.0rc.tar.gz
07/31/2019  11:37 AM            65,453 pyparsing-2.4.2-py2.py3-none-any.whl
08/07/2019  08:07 AM            56,494 pyrsistent-0.15.4-cp27-cp27m-win_amd64.whl
07/31/2019  11:37 AM           107,237 pyrsistent-0.15.4.tar.gz
07/31/2019  11:37 AM           229,590 pytest-4.6.4-py2.py3-none-any.whl
08/07/2019  08:07 AM           230,082 pytest-4.6.5-py2.py3-none-any.whl
08/22/2019  12:25 PM                 0 python
07/31/2019  11:37 AM           226,803 python_dateutil-2.8.0-py2.py3-none-any.whl
08/07/2019  08:07 AM            32,615 pywallet-0.1.0-py2.py3-none-any.whl
07/31/2019  11:37 AM            32,391 pywallet-0.1.0.tar.gz
08/12/2019  04:10 PM                32 pywallet.bat
08/24/2019  10:13 PM                 0 pywallet.py
07/31/2019  11:37 AM           210,192 PyYAML-5.1.2-cp27-cp27m-win_amd64.whl
07/31/2019  11:37 AM           514,827 requests-2.11.1-py2.py3-none-any.whl
08/01/2019  08:50 AM            57,952 requests-2.22.0-py2.py3-none-any.whl
08/14/2019  05:32 PM    <DIR>          Saved Games
07/31/2019  11:37 AM            20,919 scandir-1.10.0-cp27-cp27m-win_amd64.whl
08/14/2019  05:32 PM    <DIR>          Searches
07/31/2019  11:37 AM           575,966 setuptools-41.0.1-py2.py3-none-any.whl
08/05/2019  08:21 AM    <DIR>          setuptools.egg-info
07/31/2019  11:37 AM            30,119 sha256-0.1.tar.gz
07/31/2019  11:37 AM            10,586 six-1.12.0-py2.py3-none-any.whl
08/07/2019  10:01 AM             8,604 somepackage-1.2.3.tar.gz
08/07/2019  05:59 PM    <DIR>          src
07/16/2019  10:04 AM                 0 Sti_Trace.log
08/07/2019  08:07 AM            23,488 tabulate-0.8.3-cp27-none-any.whl
07/31/2019  11:37 AM            46,234 tabulate-0.8.3.tar.gz
08/07/2019  08:07 AM           279,935 two1-3.10.9-cp27-none-any.whl
07/31/2019  11:37 AM           226,667 two1-3.10.9.tar.gz
07/31/2019  11:37 AM            26,171 typing-3.7.4-py2-none-any.whl
08/12/2019  04:10 PM               780 update.bat
08/01/2019  08:50 AM           150,942 urllib3-1.25.3-py2.py3-none-any.whl
08/14/2019  05:32 PM    <DIR>          Videos
07/31/2019  11:37 AM            21,014 wcwidth-0.1.7-py2.py3-none-any.whl
07/31/2019  11:37 AM           200,573 websocket_client-0.56.0-py2.py3-none-any.whl
07/31/2019  11:37 AM             3,824 zipp-0.5.2-py2.py3-none-any.whl
08/07/2019  12:48 PM           213,891 zope.interface-3.7.0-py2.7-win-amd64.egg
              93 File(s)     16,852,723 bytes
              21 Dir(s)  454,830,092,288 bytes free

C:\Users\Hoss>


hope this have enough info to resolve the problem,
Thank you so very much.

It is probably more likely due to Windows 10 locking down the root directory of C: in an attempt to prevent viruses/malware from doing "bad things"™ to the system drive... and/or accessing privileged information (ie. other users data/info etc).

Where you running as Administrator? ??? If not, then try that. Also, I'd recommend not trying to scan your C: unless you have a really good reason to. Try scanning a small USB thumb drive first.

so do all paths and directories looks good?

Yes, I do run it as an admin and as a user, I found a video to switch permissions for local disk to full control will try it!
I try to scan C and a flash drive as well  ( just want to test/ properly run the program to apply it to an external drive later)
Do u recommend me to keep tweaking the current till it hopefully works,  restarting a fresh install on another fresh windows 10 or  downgrading to windows 7 and reinstalling everything??
Thank you,

OOOOOk,
Good news and Bad news!!

 the good is that I think I figured out how to make it work ( hope it's properly working)

was the wrong (PY wallet) directory, supposed to be pywallet-master not pywallet-master-win files!

tried it on a flash drive:
C:\Users\Hoss\Documents\pywallet-master>python pywallet.py --recover --recov_size=32.0Gio --recov_device E: --recov_outputdir C:\Users\Hoss\Desktop\found_wallet
Enter the passphrase for the wallet that will contain all the recovered keys: *********
Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
0.10 Go read
0.20 Go read
0.30 Go read
0.40 Go read
0.50 G


31.00 Go read

Read 31.0 Go in 14.0 minutes

Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
The wallet is encrypted and the passphrase is correct


Importing:


The new wallet C:\Users\Hoss\Desktop\found_wallet/recovered_wallet_1******.dat contains the 0 recovered key

C:\Users\Hoss\Documents\pywallet-master>

**Although I specified only 465 GB it went through all the drive 500GB**

C:\Users\Hoss\Documents\pywallet-master>python pywallet.py --recover --recov_size=465.0Gio --recov_device C: --recov_outputdir C:\Users\Hoss\Desktop\found_wallet
Enter the passphrase for the wallet that will contain all the recovered keys: *********
Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
0.10 Go read
0.20 Go read
0.30 Go read
0.40 Go read
0.50 Go read

498.80 Go read
498.90 Go read
499.00 Go read
499.10 Go read
499.20 Go read

Read 499.3 Go in 165.4 minutes

Found 2 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
The wallet is encrypted and the passphrase is correct


Importing:


The new wallet C:\Users\Hoss\Desktop\found_wallet/recovered_wallet_1******.dat contains the 0 recovered key

C:\Users\Hoss\Documents\pywallet-master>




C:\Users\Hoss\Documents\pywallet-master>python pywallet.py --recover --recov_size=465.0Gio --recov_device E: --recov_outputdir C:\Users\Hoss\Desktop\found_wallet
Enter the passphrase for the wallet that will contain all the recovered keys: *****

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:

Starting recovery.
0.10 Go read
0.20 Go read
0.30 Go read
0.40 Go read



399.30 Go read
399.40 Go read
399.50 Go read
399.60 Go read
399.70 Go read
399.80 Go read
399.90 Go read
400.00 Go read

Read 400.1 Go in 445.7 minutes

Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
The wallet is encrypted and the passphrase is correct


Importing:


The new wallet C:\Users\Hoss\Desktop\found_wallet/recovered_wallet_1******.dat contains the 0 recovered key

C:\Users\Hoss\Documents\pywallet-master>


The Bad news is the mother of old backups found nothing!!!

will try my other hard drives later, and cancel my Lexus order for now!!! :'( :'( :'( :'(

About four years ago, I bought my friend some donuts. He downloaded the bitcoin wallet app on my amazon blu phone and gave me $10 worth of bitcoin instead of cash. Since then I have switched over to an iphone, and completely forgot about my bitcoin account until recently. Is there a way to recover my bitcoin account? I know nothing about anything.

Do you have the wallet file saved with yourself anywhere?
Do you have the phrase / seed saved with you? Which wallet was that exactly? Did he put any password to protect the wallet? If yes, do you know it?

And there's nothing such a Bitcoin account, but Bitcoin wallets and addresses.

If you still have your phone, then yes you can.

/KX

Hello There,

    to avoid confusion, would you please start your own thread discussing your potential lost wallet circumstances!

Thank you and good luck.

OP: is 1HT7xU2Ngenf7D4yocz2SAcnNLW7rK8d4E your address? It was first funded in 2011, but it's also had some substantial amounts sent to it more recently (nearly $15k USD last year), which doesn't really fit your story.

Any luck recovering the funds yet?

No, no luck!!
no wallets no keys :-(
Have to scan a couple of flash drives ( one is totally dead) then read every shred of paper in my place just in case if I have any hints written/ printed. that address u mentioned Looks like it's every ones ghost address: https://bitcointalk.org/index.php?topic=1225430.0

someone said I should still scan the empty potential wallets ( 2 potential wallets found with 0 keys) not sure how good of advice this is?(maybe the program missed a key) I don't quite get it, no keys is no money/ coins right?? so why bother scan against the block chain??

   So if I got to scan quite a few hard drives, and ended up with a few partial recovered wallets, or potential wallets how can I open them??
I don't know what program to use to open the wallets/ partial recovered wallets......)
I downloaded the whole blockchain on a fresh PC and wondering if I can open them or plug them into the block chain to see if they are viable!!

when I clicked export transactions from bitcoin core it created a .csv file. how can i read its content and can i reverse it ( import to the wallet/ bitcoin core) from a potential previously created wallet?

If you have recovered "wallet.dat" files... just open them with a fully sync Bitcoin Core... You can either shutdown Bitcoin Core, switch "wallet.dat" in datadir, restart Bitcoin Core... or you can shutdown Bitcoin Core and start it from the commandline specifying which wallet file to read using the -wallet option:


So you could even try and load all of them at once, assuming you're using one of the newer "multi-wallet" capable versions.


A ".csv" file is simply text file in "comma separate values" format... You should be able to open it in any text editor to review the contents. Also, any spreadsheet app like Excel should be able to open it as well (and possibly make it slightly easier to read)

Even if you could import it back into Bitcoin Core (note: you can't), it wouldn't be much of much use in attempting to recover any funds... it's simply a list of transaction data (ie. transactionIDs and amounts etc)... it won't contain any private keys or anything like that.

This depends if that csv file was made in electrum somewhere in the past, you better not trash it because it will contain all of your private key's.

https://i.ibb.co/WK4qJWt/csv.png

Also you can import them in Electrum.
So if unsure about old data and the way it was generated, it's always better to keep all options open.

So r u saying that if I download Electrum it would be easier to open these files created by PYwallet (Jack Jack)?
is it a simple copy and paste or drag and drop?
 or do I have to know coding, programming, or how to use CMD?

Please check HCP's post:

And especially this:


You need your private keys to spend any coins.
The transaction data simply does not contain this information. And it won't help you "recovering" it. Unfortunately it won't help you recovering any funds at all.

Did you read the quote in my post? ???

It's NOT a .csv from Electrum... it's a .csv exported from Bitcoin Core... it's pretty much useless as far as wallet/coin recovery is concerned.


So, no... he can't import them in Electrum... because it's not a file full of private keys ::)


No. Pywallet creates wallet.dat's in the BerkeleyDB format that Bitcoin Core uses. These files are NOT compatible with Electrum. Electrum uses an entirely different wallet file format (JSON text with optional encryption).

I know from experience that when dealing with older data, you can never assume anything, you have to do analysis without making any assumptions.
Many people told me yes they made it in this or that application and when i scanned the drives it turned out it was a completely different story and in some cases even a different coin or a completely different password not containing even one word they was sure it contained.

The right approach is to analyze everything, regardless of what the customer claims.
 

If you never assume anything and do stuff without making any assumptions, you will never succeed in anything.

It is publicly known how wallets worked in the past and how they work now.
And a CSV export of transaction data does not contain any sensitive information (i.e. private keys). So it is pointless.

You are free to "not assume anything" and waste your time, but it won't help OP.

I also know from experience that this statement is not true.
I succeeded in many things, because i worked with what i had in stead of making assumptions.
Logic is simple it's either true or false.
There is no room for assumptions.

About helping the OP , do you think it helps to advise him to start deleting things ?

At what point did anyone in this thread advise the OP to delete anything? ???

OP was advised that they could simply open the file with a text editor (or spreadsheet) and see what was in it... but any Transaction export from Bitcoin Core would not contain any private keys and would be of very little value in coin/wallet recovery (at best, you'd get a list of addresses that you could view on a block explorer to see if they held any coins)

My bad i got these threads mixed up.

For the OP in this thread i would advise him to scan the drive in read only mode with testdisk and i am convinced that if it's still there, it will show the wallet as a deleted file with the ability to restore and save it to some other location given the one fact that the sectors have not been overwritten.

I see a lot of people advise these windows based recovery applications of which many need to be purchased and this is totally unnecessary.

You can download a free Linux live dvd and use that to boot up the computer to then mount the drive read only, then make a backup, and then start analyzing every last bit that is on that drive.

Download the ISO and either burn it to a dvd, or burn it to a USB stick using Unetbootin.
Then boot up the machine in copy to ram mode and start the terminator shell.
Then simply type testdisk and select the drive and scan it.

If unsure don't do anything and especially do not mess with the other settings so only use the analyzer function and leave the rest because if you make one mistake things will get worse.

An application that looks for specific wallet signatures would be a better idea, since it doesn't care whether metadata (such as folder and filename information) still exists. A wallet file which cannot be undeleted by standard utilities may still have recoverable fragments littered over the drive. Looks like pywallet performs such a function.

Does Pywallet copy the wallet.dat file from old drives or does it extract the whole file where I can’t find it if I rescan The same drive again??

How do I check if the partial recovered/ recovered Pywallet is a valid wallet? If it said no key found do I still check it and how?? ( is there a simple easy way)??
Thank you,

so u r saying that working off an exact bit by bit (sector by sector) clone is not as accurate? and will not properly search all files?
u still didn't answer my question!

does PYwallet extract a potential wallet.dat file from the hard drive? (Thus altering the data on the original hard drive) or does it simply copy( duplicate the wallet.dat file data)? (leaving the original hard drive as it was before the scan)

It simply reads and copies the data... it doesn't move any data from the original drive. So, using a clone should yield the same results as working from the original devices (assuming the clone is in fact an exact 1:1 copy)


Any wallet.dat file created by PyWallet should theoretically be a "valid" wallet file... it might be empty and contain no keys, but the file itself should still valid. If it said "no keys" found, then it probably won't have any keys... you can verify by using the PyWallet --dumpwallet command.

Any way some one can recover or regenerate (keys/ coins/ wallet) using a 12 word seed through an updated bitcoin core while offline?
or do u need a hardware wallet to do so?

in other words what's the best way to do an offline (keys/ coins/ wallet) recovery using a 12 word seed??

Thank you,

Import the seed into [offline] electrum and grab the wif + address.

Alternatively you can download some page and open it offline https://iancoleman.io/bip39/ (https://iancoleman.io/bip39/)

Not sure if u didn't get my question or if can't get your answer!!

My question was specifically about working offline on Bitcoin core ( that's where the original wallet was created and I have it already up to date).

Don't know much about Electrum but I though Electrum is an online only server!!

My understanding also is some/ not all hardware wallets can automatically regenerate private/ public keys ( basically restore your wallet) if you input into them the 12 words seed ( as a recovery).

Bitcoin Core does not, and never has, used 12 word seeds... if you have a 12 word seed, it was not created with Bitcoin Core.


NOTE: There was a scam clone of Bitcoin Core that supposedly had a "12 word seed recovery phrase" that would be emailed to you when you downloaded/registered for the wallet. If you used this wallet, your coins are basically lost.

WOW!! hmm, so how can I safely validate that seed I have?? any programs, software/ hardware I can use offline???
can I create a new wallet on bitcoin core using a seed where it scans through the block chain to match it??

Do you know/ remember who had a paper wallet/12 word seed back 10 years ago??
Thank you

What exactly are you attempting to "validate"? ??? Simply that it is a "valid" seed? Or that it generates a known AddressXYZ? ???

As the previous poster mentioned... running Electrum offline and using the seed there (would probably need to use "Options -> BIP39 seed" on the seed entry screen) is an option. You could also download the "iancoleman" Mnemonic Code Converter (https://iancoleman.io/bip39/) and run that offline... it has instructions at the bottom of the page.


While it is possible to create a Bitcoin Core wallet from a seed... it is NOT possible to use a seed mnemonic... It's important to note the differences... a "Seed" is technically just a very, large, random number... while a seed mnemonic is the 12/24 words.

Unfortunately, over the years... "seed" and "seed mnemonic" have been used somewhat interchangeably, which leads to confusion :-\


There is a sethdseed command in Bitcoin Core:
But you need to note that the "seed" used here is NOT a 12/24 word seed mnemonic... it is of the "very large random number" variety.


If you have a "12 word" seed mnemonic... then your best chance of recovering anything is using a BIP39 compatible wallet like Electrum.


If it is 12 English words... and you're sure that its 10 years ago... then I have no idea... BIP39 was from 2013... Electrum was originally 2011... what is the exact timeframe you are working with? ???

some where between 2009 to 2011 it's all a fading memory!

It could be an early Electrum wallet... but I think Electrum was announced late 2011... so it's not likely. Likewise, I think blockchain.info was late in 2011... and I think their early "X word phrases" (which were actually used for password recovery and NOT seed recovery) were like 15 words anyway.

Seed Mnemonics were not that common back then... I mean BIP39 was only created in Sept 2013.

Have you checked the words that you have against this list: https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt
I would also check this old Electrum list: https://github.com/spesmilo/electrum/blob/1.9.8/lib/mnemonic.py

It's possible that your timeframe is off... so:

- If ALL 12 words are in the BIP39 wordlist, try a BIP39 compatible wallet (you can also use Electrum for this... and select the "BIP39 Seed" option during seed entry)
- If ALL 12 words are in the old electrum list, try using Electrum (it'll still work with old mnemonics)

There may be other, more obscure wallets that were around in that time period... but I can't really think of any off the top of my head... :-\

Would Electrum decrypt these seeds too? is it the same math and hashing...… to get keys from words?

Thank you,

I think you didn't get my answer.
But i also think that you will get it soon tho  :)

The mnemonic code is not encrypted.
The words are the mnemonic code, which is the seed encoded into a human-readable format.

To answer your question.. no, it is not the same. BIP39 is different from electrums mechanism.
And that's the reason HCP suggested that you check this:


Could you do this and report back ?

sounds good, Will cross check them against both lists and see which is a match (hopefully)!

getting it now, u gave me the short quick answer that I didn't understand why!! but now I see that all roads are leading to Electrum!!

I forgot to mention that if you have words that are not in either list, there is a chance that it's an old blockchain.info password recovery mnemonic... in which case, you would need the wallet backup file or "wallet-ID" and possibly access to the email address you used to sign up to that service.

oh crap, aren't these the ones that require a ton of impossible info and find excuses so they would never release it to you anyway!!!

No... the password recovery system was simply that, it would allow you access back to your account... but is not capable of restoring the wallet "from nothing".

You needed the "wallet.aes.json" backup file + password (which can be decrypted with a tool provided by blockchain.info)
or
Wallet-ID + password (+ access to email for 2FA), so you can log into their website

The "old" recovery system is here: https://login.blockchain.com/wallet/forgot-password?guid=
Their "new" recovery options are here: https://login.blockchain.com/#/help (the 12 word recovery option here is only valid for HD wallets from about 2016 onwards)


Where people come unstuck with blockchain.info is that they don't understand they can't just do a password reset... your wallet is stored encrypted with your password. Not even blockchain can modify that, so if you forget your password, you're not able to recover.

People have become so used to websites being able to reset passwords, they just don't believe that blockchain can't do the same... :-\

So the words aren't all on either list!!
so if it's a blockchain password and I don't have a wallet ID can I scan my old PC to find this "wallet.aes.json" file? any special software or method to target such file??
do I have to enter the 12 words live online? or can I do it offline ( to a hardware wallet or software) to generate public/ private keys?
 any difference between blockchain.com/.info?

That is problematic, as it means it is neither a BIP39 wallet seed mnemonic, nor an Electrum wallet seed mnemonic :-\


Try the recovery methods at Blockchain.com... https://login.blockchain.com/#/help

If you don't have wallet-id, but have an idea of what email address you might have used... and you still have access to the email address, you can try the wallet-id reminder option. You can also try the "Forgot your password" option and see if it works... unlikely given you have nonBIP39 words... so also try the old recovery: https://login.blockchain.com/wallet/forgot-password?guid=


Yes, it's an online web-based platform... so if you want to try blockchain.info recovery, you have to do it via their website.


No, blockchain.info was moved to blockchain.com a while ago... the .info domain now redirects to .com

Possibly... but being a simple BIP39/Electrum seed would make things a LOT easier :-\


If so, then there is pretty much no way to recover... as far as I know, no-one has ever been able to recover if they've lost use of the email as blockchain.com can't/won't change it...


No more danger than anything you usually do online... there isn't anything you can really do except make sure you're connected to the correct website and you're fairly certain that their are no keyloggers/malware etc on your machine... possibly using a LiveOS on a USB stick with a clean install of Linux might help ensure there is no malware etc...

I'd have to be honest and say "No". Most people don't use "12 words" to encrypt/decrypt a Bitcoin Core wallet... Bitcoin Coin simply uses a "passphrase" which is essentially just a "password"...

The user is free to make it whatever they want... from a simple password like "abc123" to something very long and complex like "Th1s Is My Super SecRet P@55 Phrase That Uses Symb0ls Numb3rs and Upper and Lowerc@se Letters And is vErY Long!2020#"

you would be very surprised with what my little brain can think off, when I try to hide something I hide it sooo good even I can't find it!!!

what's better than just a pass phrase? one that consisting of 12 totally random words that makes no sense and is more unpredictable??

I still don't want to plug the 12 words I have to the blockchain.com server (yet), thinking of buying a hardware wallet as a ledger or trezor and try a 12 word wallet recover, however I believe they only accept BIP words!! :-\

This Mnemonic Code Converter (https://iancoleman.io/bip39/) has been recommended already, but I'll do it again: download it, and run it from RAM from an offline Live Linux DVD. Unplug your internet and turn off your PC to wipe it's memory when you're done.

Sorry I Don't use/ know how to use Linux, got it on a flash drive and will try it on my offline windows PC hope it works. and this also works with non BIP dictionary words too right?
Thank you.

Correct, pretty much all of the hardware wallets that I can think of utilise BIP39 wordlists for mnemonic generation and wallet recovery. I am fairly confident that any hardware wallet you buy will reject your 12 words due to the fact that you have non-BIP39 words in it.


No, it doesn't. Ian Coleman's Mnemonic Code Converter works using BIP39 mnemonic word lists. It will be of no use to your if you have words that are not in the BIP39 wordlist.
https://talkimg.com/images/2023/11/15/zYKzf.png

The 12 words you possess are not the encoded seed for all of the private keys holding your BTC.
They are basically just a recovery mechanism for a specific web wallet (blockchain.com).

You can not generate the private keys out of the words yourself. You inevitably have to enter them on blockchain.com to retrieve your coins.

Hardware wallets on the other hand use an open standard to derive private keys from a set of mnemonic code (12 words). And this standard uses the word list.
No hardware wallet can recover your coins from your blockchain.com words.

Kind of, yes.
I don't know enough about blockchain.com to answer that question with 100% certainty, since i didn't use at any time.

But the 12 words definitely were not a backup of the seed back then. So, basically, yes. Just another way of password.



I am not sure what you exactly mean with QR codes ???
Blockchain.com (formerly known as blockchain.org) was created roughly 9 years ago. And they definitely didn't follow BIP39 back then.

The QR code is this picture of a scrambled net like lines, when you scan it it reflects a real written value as a wallet address or keys..... or even a business card or a link to a website....

I'm asking because there was a paper with a QR code ( already shredded and tossed >:( >:(!!!) near where I found the 12 words.

Paper with QR code might also have been a "paper wallet"... a lot of the paper wallet generators use QR codes for ease of scanning address (and/or importing private key to wallet for redemption)... However, if it has been shredded and tossed, then obviously we'll never know for certain.

I know Blockchain can display QR codes when requesting a receive address, and it currently shows them for private keys which were imported to blockchain, but I don't think they ever used them for exporting mnemonic seeds or keys that were generated by their HD wallets...

Not sure if they ever showed QR codes for the old old wallets prior to the move to using HD wallets. However, it's been such a long time and blockchain has had so many UI/UX changes that I don't recall if they were used like that. I certainly never personally used them if they did.


Given that some of the 12 words are not even in the blockchain "password recovery" list... it's most probably that these 12 words are not even a blockchain recovery phrase, but some other obscure wallet with it's own proprietary recovery system. :-\

Blockchain.com before switching to HD wallets did have paper wallet as another form of backup. I'm not sure when did it became a thing in blockchain.com but definitely not 10 years ago cause their wallet service weren't around that time.

But still, this is what they look like and you can compare them to yours. (both source are from 2014)

1. Tutorial: Backup Basics! The Best Ways to Backup Your Blockchain Wallet (https://web.archive.org/web/20141107051853/http://blog.blockchain.com:80/2014/06/12/tutorial-backup-basics-the-best-ways-to-backup-your-blockchain-wallet/) (It doesn't look like a private key to me, not sure if it's intended that way because it's just a sample)
2. Blockchain.info Paper Backup Stores Private Keys in the Browser History (https://youtu.be/zbEoRGiONCs) (LOL)

Your old email accounts might have some trace of which wallet you've used. It's worth looking into them.

all old emails were read and eliminated except for Verizon as they don't exist, and I don't have access to it any longer!!!  >:(
I plugged in the 12 words to the Blockchain legacy wallet recovery and got a " unknown word" msg which I thought with the mnemonic words there shouldn't be such a msg since all words are accepted!!
will look up the browser history and scan for Json files on the old drives and see what I can find  :-\

No, just like other wallets... the blockchain legacy recovery system uses a "word list". If you are getting an "unknown word" error, then either one or more of your 12 words are incorrect (check spelling etc) or the 12 words are NOT blockchain legacy recovery words.

If you also get "unknown word" type errors when trying to restore using a BIP39 wallet (like Electrum with "BIP39 seed" option set or using Ian Coleman's BIP39 tool (https://iancoleman.io/bip39/)) then the 12 words are not a BIP39 recovery seed mnemonic either.

You're left with the option of it being:

1. a brainwallet... but which wallet? and what method did it use for converting words to private keys? ???
or
2. some other obscure wallet with it's own recovery system

Unless you can identify which wallet these words belong to (or possibly the incorrect word(s)), your chances of recovery are relatively slim :-\

I was just reading about using 12 words to encrypt a bitcoin core wallet!!

so apparently the 12 words maybe used to encrypt and decrypt "A" wallet, but which wallet???
 Hope its not that long gone shredded paper  ::)
However there is a list of dormant bitcoin addresses that I can try to work on every single one to try to decrypt it Using these 12 words till One works 🤔🤔
And gotta dig deeper into the old drives browser history, and cookies.
 

Can you provide the link of that paper or article?

Because as far as I know, a mnemonic phrase is mostly used as a human-readable representation of an entropy.
If it's used to encrypt a wallet, then it might a passphrase/password disguised as a mnemonic phrase.

Are you sure that you actually understood what you have read?

While encrypting a wallet(file?) with words is definitely possible, it is rarely done. And if done, it can be quite confusing.

12 words almost always are a mnemonic code which is the encoded seed which is used to derive the keys from a HD wallet.

That is correct. The encryption in Bitcoin Core is simply encrypting the private key data stored in the wallet file. The walletpassphrase could be "12 words", it could also be 200 random characters or non-existent or  some other combination of letters/numbers/symbols etc... it's basically just a standard "password"... and has no direct bearing on the ability to recreate any keys.

Historically though, "12 word" phrases (consisting of 12 "random" words) have been some form of backup/recovery system as opposed to a password.

In other words, if you have 12 words, they're probably more likely to be a mnemonic of some description than they are to be a "password", but that doesn't mean they aren't a password.


The crucial point is that Bitcoin Core has never used a mnemonic system for recovery/backup... it has always been "make a copy of wallet.dat". So, if these 12 words are indeed a recovery mnemonic of some description, they're most likely not related to Bitcoin Core.

The link you've provided is just about encrypting Bitcoin core's wallet file, not specifically "12-words to encrypt".
Anyways, it will accept 12-words as a passphrase because core accepts spaces.

---

Please fix your quote, it looks like the text in the middle was posted by me:

Insert [/quote] after "Can you provide the link of that paper or article?"
And insert [quote author=nc50lc] before "Because as far as I know" to fix it.

so to be sure I have PYwallet properly installed and operating as it should, I ran it on a hard drive with bitcoin core (which I assume should already have a wallet and keys) , I also had a folder of previously found/ created wallets and partial wallets (results from running PY wallet multiple times on multiple drives) on that same hard drive, ran PYwallet and got this result: Found 70 possible wallets
found 0 possible encrypted keys
found 0 possible unencrypted keys
the wallet is encrypted and the passphrase is correct
importing:...…..

 I was hoping PY wallet would recognize the bitcoin core wallet and I would get at least the one good key off the drive!!
what am I doing wrong??

then since I'm pretty bad with computers, don't trust myself with proper installation, operation of PY wallet and can't run simple commands as dump wallet or privkeys…..  I ran Electrum to sweep keys from the Py wallet generated/ found wallets which gave me a page full of numbers multiple lines of zeros and a bunch of numbers on the last 3 lines. looked it up and referred me to adding p2wpkh IN front of the key but its a whole page full of numbers and I can't tell which is the key!!

any advice??
Thank you,

pywallet with the --dumpwallet switch writes the private keys to a JSON file which is a kind of file that has a structure like this:

{
   "key": "value",
   "key2": [1, 2, 3],
   "key3": {
        "subkey": "anothervalue"
    }
}

and so on. If your file doesn't look like this, then it was created with another pywallet command.

In your case, look for a key called "keys", and it's going to have a list of key-values {} in them that have "address" and "sec" subkeys. The "sec" key has your private key inside and it begins with a "H","J","K" or "L" (or any of these with a "5" at the beginning). This is what you import into Electrum.

"addr" is the address for the private key. Look at the characters at the beginning ("1", "3", or "bc1") and add the correct prefix in front of the private key to import it into Electrum (p2pkh: , p2sh: , or p2wpkh: respectively).

If you don't see "sec" keys next to "addr" keys then it means that particular private key is encrypted and you need to run "pywallet --dumpwallet --passphrase yourpasswordhere" to decrypt it.

I'm sorry I'm a little confused, this thread is a year and a half old and I don't get if you managed to find any wallet or key
Based on this I guessed not
The 70 only means pywallet found 70 master keys (wallet encryption parameters) but no addresses at all, this is weird

When were the wallets created? Are you sure it is a bitcoin-qt/core wallet?
BTW I found out the pywallet recovery is bugged, I fix a bit of that a couple hours ago you can try the new version and see if it finds any key
I'll be fixing this over the next weeks

Well the recovery has some bugs but from my tests it finds at least a few keys for recent wallets
Things will be clearer in a few weeks

Are you absolutely sure that all those wallets aren't just password-protected with no receiving addresses created for it yet?  ???

Core doesn't create receiving addresses for new wallets by default, you have to explicitly tell it to give you an address so it's possible the wallets you're trying to dump were only created but never used (by virtue of having not receiving addresses for it).

As far as looking for the private key is concerned, look for something with "5H" "5J" "5K" or "5L" at the beginning of a line.

Are you absolutely sure that all those wallets aren't just password-protected with no receiving addresses created for it yet?  ???

Core doesn't create receiving addresses for new wallets by default, you have to explicitly tell it to give you an address so it's possible the wallets you're trying to dump were only created but never used (by virtue of having not receiving addresses for it).

As far as looking for the private key is concerned, look for something with "5H" "5J" "5K" or "5L" at the beginning of a line.

[ I believe the 70 found "wallets" were probably the empty .dat files created by PYwallet when I ran it (probably 70 times)!!

 I thought that bitcoin core automatically creates one wallet when installed, I wasn't trying to dump wallets as I don't know how, was just trying to find a wallet then go to the next step of extracting keys and........ so now I'll plug in a drive with electrum wallet and a backed up bitcoine core wallet to test the PYwallet again to see if PYwallet works as designed on my machine, I also just learned that it doesn't look into compressed files, back up files in their current status no wonder I can't find any wallets ::) will have a long way to find good quality programs to decompress and decipher/make backup files readable to PYwallet, I was using windows search looking for .dat files on a 500 GB drive yesterday and it said it needs 1.4TB disk space :o
.]

Bear in mind that searching only for files that have a .dat file extension at the end will give you A LOT of false positives. .dat's usage is extremely loaded and dozens of programs store their own different file format in files that have this extension, so you might end up with a bunch of .dat files that are not wallet files!

that’s what PYwallet is for though, right?
I’ll pile up 1.5 GB of .dat files run it and The program will do the work, skip the junk and find wallet files if present!
I’ll have to buy a bigger hard drive!!

Well technically it is going to skip over the .dat files it can't read and raise an error, but the more errors related to unreadable files are in your log the output for the real wallet.dat files are going to be buried under an avalanche of "cannot read file" kind of messages.