Bitcoin Forum

HI everyone,
This evening I did a clean reinstall of windows, however I forgot to move my wallet.dat. When I realized my mistake, I booted into a live cd of ubuntu. I tried to recover the keys using this https://bitcointalk.org/index.php?topic=25091.0, but it said the command was not found. Can anybody help me out.
Much thanks

Honestly you're probably fucked. Which command wasn't working?

Does that mean it searched your drive and found nothing?  Or that you couldn't get the command to start?  How long did the command "think" before it decided it didn't work, and how big is the drive?

I just successfully recovered someone's BTC just a few days ago... we did it by installing windows on a different boot drive, and then I got on GoToMeeting and dug up his BTC with a hex editor.

LEARN TO BACKUP VALUABLE DATA :<

Which command wasn't found?
There are a couple steps to the whole procedure and you haven't told us which one failed.

Well... Just don't write anything to that drive until you have either recovered your BTC or determined it's a lost cause.  Don't boot it, don't install anything to it, don't save anything to it.

Was it a decent amount worth major effort to save?

A hex editor can determine very quickly if there is a recoverable wallet on the drive.  The wallet will be completely recoverable if it is on sectors that have not been overwritten.

Yeah, it's a 125 bitcoins. I forgot to add that it's an ssd too, and also that I had a 2 month old copy of wallet.dat on my flash drive, before I deleted it since I was going to move the new wallet.dat onto it. The command ./wallet-recover-0.2-linux/bin/32/wallet-recover did not work.

i have done many clean reinstalls of my Windows, and it simply renames the old copy to windows.old - unless you meant you did a format?
if format, use a file recovery program such as piriform's Recuva - as mentioned before, do not boot or write ANYTHING to the drive.

This highlights why all wallets need to be deterministic.  As user base grows you will get less and less tech savy users.  A strongly encrypted, lose it and you are fucked wallet is fine for power users, businesses, custom development but not for Joe Sixpack.

Still not sure if you mean a) you tried to run this command and the program did not run or b) the program did run but after scanning your entire drive it did not find anything.

Which is it?

Since it is over $600 (at this time) you might be able to ship your drive to someone who knows how to do this and pay them a finders fee if they can find it (?)

did you delete the partition?

Yes, I unfortunately reformatted the drive.
I loaded up a ubuntu live cd, opened the terminal and entered
"wget http://www.makomk.com/~aidan/wallet-recover-0.2-linux.tar.gz
tar xzf wallet-recover-0.2-linux.tar.gz"
then I entered this

sudo ./wallet-recover-0.2-linux/bin/32/wallet-recover /dev/sda recovered-wallet.dat
however the terminal said that this command "
/wallet-recover-0.2-linux/bin/32/wallet-recover"
was not found.As for shiping my drive, is their anyone who can fix it for me like that and for what fee.
Thanks for the replies

Where are you located ? What SSD was it ?

this sounds to me (with virtually no linux experience) like the actual wallet-get program isn't installed to your live cd (ram drive, whatever) properly or you are trying to access the wrong path.


edit: i'm pretty sure that you can get UBCD4WIN that has recova or similar program on it - even linux live-cd's should have some kind of recover-file-after-format utility on them, try an inbuilt one & ask it to search specifically for wallet.dat

If all else fails, I can do it for 20 BTC, payable only if successful, plus the cost of return shipping for your drive regardless of success assuming you want it back.  If your wallet was encrypted, I will need the encryption password you used.

Here was my last successful recovery. https://bitcointalk.org/index.php?topic=56023.msg672983#msg672983

My mailing address is on my website in my sig line.

Your chances of recovery are maximized if you do not boot the drive and do not write anything to it.  Feel free to boot other drives and play with your drive as a secondary drive, but don't let it start as primary.

THIS.

If you don't follow this instruction you can kiss any chance of recovery goodbye.

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

that's nasty!

can you make a clone image using a program designed to image corrupt hdd's? this way you can poke and probe without fear of this garbage collection performing.

also, y u no old backup?!
just discussing on a different thread about the wallet, an old backup will restore up to 100 post-backup keys/transactions from the backup date.

That might actually be a very good idea to do before anything else. 

I suppose whether or not an SSD will garbage-collect abandoned data after a format would be highly dependent on whether the formatting OS issued a TRIM command to the drive to explicitly signal that the data is no longer needed, specifically TRIMming the entire drive as a whole.  I am not entirely sure whether or not that happens during a disk format operation.  But such idle garbage collection is only a concern if the answer to that question is yes.

EDIT: I just googled and found this: http://digfor.blogspot.com/2011/08/ssd-trim-encryption-formating-and.html - which, if correct, would be bad news.

I don't know about other OS but I do know Windows 7 specifically (both install DVD and OS internally) fire TRIM on a format for all blocks in the format.  Ironically this was considered a good thing when it was announced (because otherwise a format won't solve various performance problems).

what program do you suggest?

I'm located in the Bay Area. It's a 40gb Intel X25-V

i have never done it before, only had to do a couple of data recoveries from disk hdd's & they were in decent enough shape i wasn't afraid of it suddenly grinding to a halt.

perhaps norton ghost? i am not sure.

I will do it for 15 BTC if successful. Can you ship to the UK ?

I was hoping I could do something on my own to solve it. Will the hex editor method work on a SSD?

Yes it will work, though it just may not find anything.

If a hex editor can't find your wallet, I can't either.

How about the wallet.dat on the Flash drive? The only diffrence between that and the one on the ssd is 1 transaction and I put a password on it. Thanks for your help.

An old wallet has a VERY GOOD chance of being usable to recover bitcoins, even if they were received after the backup was made.

Make an extra copy of the wallet for safekeeping.  Then, shut down Bitcoin, put a copy of the flash drive wallet in place of the empty wallet.dat that was created by Bitcoin, and then restart Bitcoin with the "-rescan" command line switch.  This takes several minutes.  If any coins are recoverable and your block chain is up to date, they will show up in your balance.

Sorry I left out important information. I deleted the wallet.dat file on the flashdrive because I was going to move the updated wallet.dat onto it, which I forgot to do. I'm asking if the deleted wallet.dat on the flash drive is recoverable.

Since you did not reformat it, and assuming you have not written to it then it should be easier to recover than from the formatted drive.

Very possibly, yes.

Install WinHex on your machine.  Insert the flash drive.  Run WinHex as administrator by rightclicking its icon and selecting Run As Administrator.  In WinHex, press F9 to see a list of physical drives, choose the flash drive.  (It appears twice, once as a drive letter and once as a physical device.  Choose the physical device - the bottom one.  If you did not run WinHex as administrator, flash drive will not appear in the physical media list.)

Perform a hex search on the entire drive.  Search for the following hex: 01036B657941.  It should take several minutes.  If you find a search result from these bytes, recovery from the drive is likely possible.  Do it, and let us know how it worked.  The recovery itself may be more complex, but at least you'll know it's there.

In the meantime, DO NOT SAVE OR WRITE any files to the flash drive.

I found that series on my drive. What next? Thanks again for all the help

I offer to do a GoToMeeting recovery for 10 BTC.  (GoToMeeting is a commercial web conferencing platform I subscribe to.  I would invite you to a web meeting, make you the "presenter", and you offer control of mouse and keyboard.)

Meanwhile, here are the steps I intend to do (you're welcome to attempt DIY if you want by all means):

1. Repeat your search
2. Form an opinion as to which sectors belong to your wallet by scrolling through sectors on your flash drive (this is the subjective part)
3. Export those sectors to a file.
4. Have you open your e-mail so I can e-mail myself the file.
5. Use a utility on my side that breaks the private keys out of the file (I wrote it, it's a custom script).  The way this script works is described in a thread linked to previously in this thread.
6. Import them into a wallet and do a rescan (this takes 10 minutes)
7. Send you the BTC to the address of your choice

Outcome: SUCCESSFUL RECOVERY.

Robert accepted a GoToMeeting invitation from me.  We had trouble with GoToMeeting, it would only let me see his screen, not control his computer.  Regardless, I just gave him instructions of what to click through the chat window.  I suppose it slowed us down some, but it still didn't take too long.

We repeated the hex search he said was successful on his 8GB USB flash drive.

I had him copy a group of sectors that appeared to contain wallet data.  He copied and pasted it to a file and e-mailed it to me.

We searched the remainder of the drive for additional wallet fragments and found none.

I used my script that digs through the raw data, looking for "0420" which marks private keys.  It grabs all of the keys (typically there will be over 100), and auto-generates a script that allows the creation of a brand new wallet.

After rescan, his full balance was recoverable.  I sent it to a brand new bitcoin address.

Successful recoveries are always better than having to tell people they are SOL, especially if it's a lot of money.

That is great!  I guess you now have another new side business :)

Yeah he is 2 for 2 now right and both were good sized wallets.

Out of curiosity why isn't there a mechanism to write two wallet.dats atomically (both have to succeed), one to the [%APPDATA%|$user]\bitcoin directory, and another to a usb key or alternate drive?

or even to -dumpwallet after each transaction on the client?

marked

Because we don't have infinite programming resources, and we've been busy working on low-level stuff that will lead to solutions that will fix the "my hard drive crashed" and also the "my computer got infected by malware" and "my house burned down along with my computer and all of my USB thumbdrives" disaster scenarios.

What's the problem with making the backup yourselves?
It's the same as loosing your Outlook inbox or, worse, your personal documents and pictures.

Backups are essential.

How much money is involved?  You can always contact casascius and he can help you for a fee.  He is very good at it and worth every bit cent!