Print Page - Lost wallet? Help me find out

Updated, View second page please

Hello there,
After all this bullrun, I've been searching for old wallets I had, back when I was young and innocent.
I've found a 12 phrase on a text document and another long "word" with random letters. Starts with xc2.....2om, it's 32 characters long. Have no idea what it could actually be.

Furthermore, I found a file, approximately 80mb with the name "wallet". Just that, no extension, nothing.

I've already tried importing the 12 phrase on a Bitcoin wallet but says invalid. I'm suspecting that they could be something else too.

Anyone of any assistance please? What is this "wallet" file, that 32 character object? Any chances that the 12 word phrase belongs to another coin?

Thank you in advance

Hi
I don't know if you can move your thread yourself but the forum for technical help is there: https://bitcointalk.org/index.php?board=4.0
12 words phrase is likely a BIP39 or Electrum mnemonic, try using tools on internet but use them OFFLINE! I just found this for example https://iancoleman.io/bip39/
The 80MB wallet may be a Truecrypt/Veracrypt container?
Your 'xc2.....2om' word may be a password? Of the container? Or a BIP38 password for your keys?

Are you sure that the wallet file doesn't have the extension? Or it might be just hidden? check carefully because there are some users here who mention about 80MB of the wallet.dat file of their Bitcoin core wallet.

Here's the post below for reference
- https://bitcointalk.org/index.php?topic=34028.msg2570257#msg2570257

About the 12 phrase seed can you try to check the words from your backup seed with this list of words from here https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt
Check if all of the words from your backup seed are under that list. If some of the words are not there it means it's a different wallet.

It might be a litecoin or other coin. Can you try to check if when it was created? Try to right-click the file that has 12 phrase backup and click properties it should be show details with the date when it was created.

Quote from: jackjack on February 06, 2021, 09:28:08 PM

Thank you for your reply, I've no idea what Truecrypt/Veracrypt container is lol, so I doubt that it's that. Furthermore, I don't really understand what this tool you've attached does. I'd really appreciate if you could elaborate.

Quote from: BitMaxz on February 06, 2021, 10:27:43 PM

Thank you, I've checked the attached list and all words do match up. I've tried importing it using a desktop wallet by inserting the 12 word phrase with no success. The text was created on December of 2018. I've no idea on how to test that "wallet" file.

Quote from: Ultegra134 on February 06, 2021, 11:00:11 PM

Quote from: jackjack on February 06, 2021, 09:28:08 PM

In this tool you put your 12 words in "BIP39 Mnemonic"
This will give you a private key in "BIP32 Root Key"
You may need to put your "xc2" password in "BIP39 Passphrase (optional)" too

Then you can import the two "BIP32 Root Key" (the one with xc2 in BIP39 Passphrase and the one without) in Electrum (I'm not sure bitcoin-core has implemented BIP32 yet) and use your funds if it works

Quote from: jackjack on February 06, 2021, 11:38:50 PM

Quote from: Ultegra134 on February 06, 2021, 11:00:11 PM

Quote from: jackjack on February 06, 2021, 09:28:08 PM

In this tool you put your 12 words in "BIP39 Mnemonic"
This will give you a private key in "BIP32 Root Key"
You may need to put your "xc2" password in "BIP39 Passphrase (optional)" too

Then you can import the two "BIP32 Root Key" (the one with xc2 in BIP39 Passphrase and the one without) in Ethereum (I'm not sure bitcoin-core has implemented BIP32 yet) and use your funds if it works

Thanks, I've tried that but it says invalid mnemonic. Tried using the password too but made no difference.

Quote from: Ultegra134 on February 07, 2021, 12:07:03 AM

Thanks, I've tried that but it says invalid mnemonic. Tried using the password too but made no difference.

Then it's possible that one (or more) of the words is "incorrect"... have a look through that BIP39 wordlist for "similar" words that may have been written down/typed out incorrectly... things like kid, kit, kite etc...

Quote from: jackjack on February 06, 2021, 11:38:50 PM

Then you can import the two "BIP32 Root Key" (the one with xc2 in BIP39 Passphrase and the one without) in Ethereum (I'm not sure bitcoin-core has implemented BIP32 yet) and use your funds if it works

I'm sure you meant "Electrum" ;)

And Bitcoin Core does use BIP32 to generate keys in the HD wallets, and with the advent of "descriptors", you can import xpubs and xprvs... using the importdescriptors command, refer: https://github.com/bitcoin/bitcoin/blob/master/doc/descriptors.md#bip32-derived-keys-and-chains

Quote from: HCP on February 07, 2021, 12:21:51 AM

Quote from: Ultegra134 on February 07, 2021, 12:07:03 AM

Thanks, I've tried that but it says invalid mnemonic. Tried using the password too but made no difference.

Isn't there a tool out there to bruteforce a sentence with one bad word?
I think so but if not I can make one quickly

Quote from: HCP on February 07, 2021, 12:21:51 AM

Quote from: jackjack on February 06, 2021, 11:38:50 PM

Damn, nice catch, fixed
So many common letters, that should be forbidden!

Good to know bitcoin-core can import BIP32 HD wallets!

Quote from: jackjack on February 07, 2021, 01:33:48 AM

Isn't there a tool out there to bruteforce a sentence with one bad word?
I think so but if not I can make one quickly

Yep... btcrecover can usually work it out fairly quickly... however you need the "incorrect" seed, and a known address generated by that wallet. Sounds like the OP may not have the address. :-\

This is the most "up to date" version of btcrecover (that has added extra features over the original by gurnec): https://github.com/3rdIteration/btcrecover

Quote from: HCP on February 07, 2021, 02:17:30 AM

Quote from: jackjack on February 07, 2021, 01:33:48 AM

Isn't there a tool out there to bruteforce a sentence with one bad word?
I think so but if not I can make one quickly

Unfortunately, that is correct, I do not even have the address. If I did, I could see if it was worthy of recovering, I cannot even guarantee that it's not another empty wallet.

So far, I've recovered three wallets, one of them was intact, another one was simply empty and the last one had $100 in it. This is a file I found randomly on my drive, the 12 word phrase could also point to one of these 3 wallets.

Quote from: Ultegra134 on February 07, 2021, 03:03:26 PM

So far, I've recovered three wallets, one of them was intact, another one was simply empty and the last one had $100 in it.

how is this $100 showing up?
there must be either an address that has that balance or a transaction that shows this received amount. can't you use that to extract your possible address and then check it against your 12 words?

Quote from: BrewMaster on February 07, 2021, 03:43:07 PM

Quote from: Ultegra134 on February 07, 2021, 03:03:26 PM

So far, I've recovered three wallets, one of them was intact, another one was simply empty and the last one had $100 in it.

The three wallets I'm mentioning have nothing to do with the 12 word phrase I have. I am just suspecting that the phrase might be from one of the wallets I found and recovered successfully. These three wallets were online Blockchain ones, and were recovered by looking back on my old email, finding the wallet IDs and guessing the passwords.

Given that your 12 words are all in the BIP39 list, but giving "invalid mnemonic" (and if you've already tried the "similar word" approach and had no luck) another option might be writing a script that tries all the different permutations of those specific 12 words, looking for "valid" mnemonics...

With a set of 12 words... you're looking at 12! permutations = 479,001,600... and given the way the "checksum" works, not all of those permutations is actually going to be valid.

Unfortunately, I suspect that any given 12 words would generates tens of thousands (if not millions) of valid seed combinations (maybe ~5%? ???) :-\ So, while getting a script to generating and identify all the "valid" seeds from your 12 words probably isn't that difficult, the trick will be identifying which one of those valid seeds actually has "in use" keys attached to it. :-\

Quote from: Ultegra134 on February 06, 2021, 09:22:09 PM

I've found a 12 phrase on a text document and another long "word" with random letters. Starts with xc2.....2om, it's 32 characters long. Have no idea what it could actually be.
Anyone of any assistance please? What is this "wallet" file, that 32 character object? Any chances that the 12 word phrase belongs to another coin?

Open the wallet file in hex editor (like hexinator) and post the screenshot of it, so we can identify with the header what kind of file is that.

Quote from: plen on February 09, 2021, 10:36:52 PM

Quote from: Ultegra134 on February 06, 2021, 09:22:09 PM

Any chances that the 12 word phrase belongs to another coin?

Just out of curiousity have you tried this phrase with an ETH wallet?

Nope, it's funny that I didn't think of that earlier. Will try that out and report back, thanks!

Quote from: cajancharles on February 11, 2021, 09:21:15 AM

Quote from: Ultegra134 on February 06, 2021, 09:22:09 PM

Open the wallet file in hex editor (like hexinator) and post the screenshot of it, so we can identify with the header what kind of file is that.

Will try that as soon as possible and report back. I hope we can come up with something of value. Thanks you!

Quote from: cajancharles on February 11, 2021, 09:21:15 AM

Quote from: Ultegra134 on February 06, 2021, 09:22:09 PM

Open the wallet file in hex editor (like hexinator) and post the screenshot of it, so we can identify with the header what kind of file is that.

Okay, I downloaded Hexinator and opened the file with it. I have no idea what this thing is, posting a screenshot. I hope you can understand what's going on here. Report back if you need me to do anything else with the file.

https://i.ibb.co/B3WvLhG/hex.png (https://ibb.co/3d6V1xv)

It's a JSON format wallet... and it looks a lot like the Electrum wallet file format:

Code:

{
    "addr_history": {
        "12B..........................HR": [],
        "13Q..........................BX": [],
        "13i..........................u9": [],
        "16B..........................qn": [],
        "19A..........................Gu": [],
        "19V..........................yv": [],
        "1A9..........................Ro": [],
        "1Ak..........................Bb": [],
        "1Bk..........................W3": [],
        "1Br..........................RL": [],
        "1Cm..........................eN": [],
        "1Co..........................NF": [],
        "1EV..........................4E": [],
        "1F1..........................KX": [],
        "1H3..........................NP": [],
        "1HK..........................Sj": [],
        "1Ha..........................oK": [],
        "1LZ..........................ib": [],
        "1M6..........................yH": [],
        "1NF..........................Vh": [],
        "1PQ..........................7k": [],
        "1Pa..........................PN": [],
        "1Pb..........................1Q": [],
        "1Pj..........................wL": [],
        "1Q4..........................qt": [],
        "1QL..........................tN": []
    },
    "addresses": {
...

However, given that the addresses all start with a "G"... it's not a Bitcoin wallet... possibly Bitcoin Gold? ??? You could try opening it with the BTG fork of Electrum called "ElectrumG" from here: https://bitcoingold.org/electrumg/

Quote from: HCP on February 15, 2021, 07:27:50 PM

It's a JSON format wallet... and it looks a lot like the Electrum wallet file format:

Code:

{
    "addr_history": {
        "12B..........................HR": [],
        "13Q..........................BX": [],
        "13i..........................u9": [],
        "16B..........................qn": [],
        "19A..........................Gu": [],
        "19V..........................yv": [],
        "1A9..........................Ro": [],
        "1Ak..........................Bb": [],
        "1Bk..........................W3": [],
        "1Br..........................RL": [],
        "1Cm..........................eN": [],
        "1Co..........................NF": [],
        "1EV..........................4E": [],
        "1F1..........................KX": [],
        "1H3..........................NP": [],
        "1HK..........................Sj": [],
        "1Ha..........................oK": [],
        "1LZ..........................ib": [],
        "1M6..........................yH": [],
        "1NF..........................Vh": [],
        "1PQ..........................7k": [],
        "1Pa..........................PN": [],
        "1Pb..........................1Q": [],
        "1Pj..........................wL": [],
        "1Q4..........................qt": [],
        "1QL..........................tN": []
    },
    "addresses": {
...

Great work, thanks! Cannot even remember I had such wallets, of any other coin though. It's quite fascinating that I keep finding wallets, addresses and 12 word phrases. Will download it and report back as soon as possible.

Thanks again!

Quote from: HCP on February 15, 2021, 07:27:50 PM

It's a JSON format wallet... and it looks a lot like the Electrum wallet file format:

Code:

{
    "addr_history": {
        "12B..........................HR": [],
        "13Q..........................BX": [],
        "13i..........................u9": [],
        "16B..........................qn": [],
        "19A..........................Gu": [],
        "19V..........................yv": [],
        "1A9..........................Ro": [],
        "1Ak..........................Bb": [],
        "1Bk..........................W3": [],
        "1Br..........................RL": [],
        "1Cm..........................eN": [],
        "1Co..........................NF": [],
        "1EV..........................4E": [],
        "1F1..........................KX": [],
        "1H3..........................NP": [],
        "1HK..........................Sj": [],
        "1Ha..........................oK": [],
        "1LZ..........................ib": [],
        "1M6..........................yH": [],
        "1NF..........................Vh": [],
        "1PQ..........................7k": [],
        "1Pa..........................PN": [],
        "1Pb..........................1Q": [],
        "1Pj..........................wL": [],
        "1Q4..........................qt": [],
        "1QL..........................tN": []
    },
    "addresses": {
...

One more question please, could it also be something else? Like Bitcoin Cash? I mean, can those two get confused? If I open it with ElectrumG, will it be BTG 100%?

Quote from: Ultegra134 on February 15, 2021, 09:08:39 PM

One more question please, could it also be something else? Like Bitcoin Cash? I mean, can those two get confused? If I open it with ElectrumG, will it be BTG 100%?

Definitely not Bitcoin Cash... BCH used either the identical addresses to Bitcoin (as it was, falsely, claiming to be Bitcoin ::)) or their "cashaddr" format... but it could be another altcoin that also used addresses that start with a "G" and has a fork of the electrum wallet.

I'm not aware of any other altcoins with addresses that start with a "G"... but then, I haven't really looked... the main one I know is BTG.

Quote from: HCP on February 15, 2021, 09:21:05 PM

Quote from: Ultegra134 on February 15, 2021, 09:08:39 PM

One more question please, could it also be something else? Like Bitcoin Cash? I mean, can those two get confused? If I open it with ElectrumG, will it be BTG 100%?

I see, not currently at home to download ElectrumG to try it out. Let's suppose I import the file and shows a balance of 5 BTG for instance, I guess it's fine then? I mean, then it's confirmed to be 100% BTG and not something else, right?

Quote from: HCP on February 15, 2021, 10:29:36 PM

Yeah... if it shows a transaction history (not necessarily a positive balance :P), then the likelihood of it being something else are about the same chances of randomly typing in a private key and it being to one of Satoshi's old addresses :P

Alrighty, I got news, but not necessarily good. It got me excited at first, at least I had some euphoria feeling for a while. Saw 107 coins, multiply that by $28 each BTG, I was like "I'm rich!"

https://i.ibb.co/BngtkX6/grlc.png (https://ibb.co/bbrPtSv)

Well nope, although it appears to be fine, when you try to send to an address, it says that you're using a low fee, despite using the max possible fee you can. The reason for this? It's not a BTG wallet, went through transactions, and they wouldn't appear on the BTG explorer. Googled one of the addresses and found that it was...GARLICOIN, for God's sake I felt so disappointed.

Not even that but also, I tried recovering it by downloading a Garlicoin wallet but couldn't find how to import that wallet file. I mean, it's $2.5 worth of coins, but supposing that one (Nope) day they were worth something more, I could make something out of it.

Thank you very much for your assistance so far!

Quote from: HCP on February 16, 2021, 01:22:05 AM

Maybe try "Garlium": https://xske.github.io/garlium/

It is supposedly an Electrum fork for Garlicoin

Also, I must apologise... I forgot that Electrum stores the wallet history in the wallet file... so that would explain why it could see it all, but didn't actually sync properly or allow you to send. It's when you import private keys that it needs to scan from scratch. :-\

No worries mate, I actually opened the wallet file with Garlium, instead of another one I had downloaded from the official Garlicoin website. Works fine, despite the fact that...it has 5 coins only. lol.

https://i.ibb.co/stj4wSX/grlc2.png (https://ibb.co/7bvDWc0)

I still appreciate your time and effort you put into helping me. I wish we could have actually recovered something of worth, then I would have definitely sent you a reward as an appreciation of your effort.

Quote from: Ultegra134 on February 16, 2021, 10:21:19 AM

Yeah... it's like opening my old Byteball/OByte wallet and seeing "thousands of coins" and checking the price and thinking that I've done OK... only to realise the price is actually for a "GByte"... and I'm looking at the Byte value! :D ::) :-\

Quote from: Ultegra134 on February 16, 2021, 10:21:19 AM

I still appreciate your time and effort you put into helping me. I wish we could have actually recovered something of worth, then I would have definitely sent you a reward as an appreciation of your effort.

All good... always happy to help (or try to anyway :P)... generally end up learning something new along the way! ;)

Hello there,
Wasn't intending to unbury such an old thread, but since I've already created one in the past for the exact same issue, I decided not to open a new one. A few days ago, I stumbled on a few HDDs when clearing up old cabinets, along with my long-lost external HDD case and decided to have a quick look at one of the drives, which could have possibly had a wallet in the past.

Hooked up my drive, everything was running smoothly, didn't find anything interesting related with cryptocurrencies, so I decided to run Recuva.
https://i.ibb.co/xGZcZHD/IMG-20220503-213835481-HDR.jpg (https://ibb.co/jGtxtRT)

After an hour or two of scanning, I found and restored two "default_wallet" files and one BitGo keycard, which I'm in the process of recovering the account. First and foremost, though, I wanted to fiddle with these two wallet files, which appear identical. Recuva is claiming that there were no overwritten sectors and the file appears in excellent condition, I have my doubts.

Thanks to HCP and the previous posters, I downloaded Hexinator again and tried reviewing the file, however, it looks corrupt to me. Can someone more experienced confirm, and if it is, can anything be done to restore it?

https://i.ibb.co/f1kvN2x/hexinator.png (https://ibb.co/NV9SNsy)

Quote from: ETFbitcoin on May 05, 2022, 11:58:37 AM

Quote from: Ultegra134 on May 04, 2022, 07:01:23 PM

Thanks to HCP and the previous posters, I downloaded Hexinator again and tried reviewing the file, however, it looks corrupt to me. Can someone more experienced confirm, and if it is, can anything be done to restore it?

https://i.ibb.co/f1kvN2x/hexinator.png (https://ibb.co/NV9SNsy)

Looking at the name of file, most likely it's wallet file for Electrum (and it's forks). Newer Electrum encrypt everything by default, so it's hard to guess whether is corrupted or not. I know Electrum has magic bytes to identify what kind of encryption is used[1], but unfortunately i don't where Electrum store it's magic bytes.

[1] https://github.com/spesmilo/electrum/blob/6650e6bbae12a79e12667857ee039f1b1f30c7e3/electrum/storage.py#L135-L145 (https://github.com/spesmilo/electrum/blob/6650e6bbae12a79e12667857ee039f1b1f30c7e3/electrum/storage.py#L135-L145)

Thank you for your response, I hadn't thought myself that it was possibly encrypted, however, I'm prepared for the worst case scenario, thus, I'm not getting my hopes up nor am I excited. I'm suspecting a wallet which did have a small balance inside, it could be this one. Unfortunately, I tried setting up Electrum and using the specific wallet file but it failed to open it.

Quote from: ETFbitcoin on May 06, 2022, 11:44:16 AM

Quote from: Ultegra134 on May 05, 2022, 06:01:35 PM

Quote from: ETFbitcoin on May 05, 2022, 11:58:37 AM

At least make sure you backup the wallet file and all relevant information (e.g. hint of the password, when it's created). You also might want to make a raw copy of your HDD. It's possible you could find way to restore it in the future.

Quote from: Ultegra134 on May 05, 2022, 06:01:35 PM

Unfortunately, I tried setting up Electrum and using the specific wallet file but it failed to open it.

What exactly do you mean by failed to open? You don't know the password? Electrum say it's corrupted/other error message?

I'm trying to load the file, but Electrum freezes for approximately 2-3 minutes. Tried both wallet files, but the same thing occurs. It stops responding, shortly after an error message appears claiming that it has failed to read the file. Is there any chance that it would be a different kind of wallet, such as Ethereum for instance, and hence the reason it's not reading it?

On the other hand, chances are that it's simply corrupt.

Edit: Just recovered the BitGo wallet, it's empty :(

Quote from: Cricktor on May 06, 2022, 10:40:53 PM

Not sure if any old Electrum version encrypted its wallet file as binary (non-ASCII) gibberish. More recent Electrum encrypted wallets are completely ASCII printable gibberish, your Hexinator screenshot looks completely different from that.

Earlier versions (I believe pre 3.0) didn't encrypt the whole file and only the secrets but they've always used AES which would return a byte array (each value would be between 0 to 255) hence the result on disk would always be gibberish and not ASCII.

Bitcoin Forum

Bitcoin => Development & Technical Discussion => Topic started by: Ultegra134 on February 06, 2021, 09:22:09 PM