Bitcoin Forum

I need some help...

Long story short - lost all data on my hard drive and my external back drive.

I ran Photorec and recovered over 1 million files from hard drive, and if any of you has ever had to do that (so sorry)... you know the files are recovered with a generic name and most extensions are changed to txt.

Anyhoo - to locate wallets in the abyss, I can search the content of the files (grep recursive), but I don't have a freakin clue what's in a wallet.dat; never tried to open one.

That said - does anyone have some generic line of text from a wallet.dat that I can use to query a mil+ freakin txt files? I'm sure it's going to recover wallet.dat from backups, the trash, and even temp directories. I'm sure I'll have hundreds of wallet.dats, with only one being the one I need. So wondering... once I locate these files (fingers crossed), is there a way to identify the coin they belong to or date it was last updated or something?

Someone please help!

About the bounty - If you hadn't guessed by now my coins are on this hard drive. But I do have a lil bitchange in an exchange wallet that I'm willing to share.

Try this : https://github.com/pilate/keyhunter



FaSan

Excellent! So the output would be the balance and I can just pluck the keys that have balances?

No this software scan all sectors in your hdd and recovery only the privatekeys. No balances.



FaSan

Oh, ok. Forgive me... not much of a techie. But once I get the private keys, then what? Fingers crossed that all of my important wallet.dats are recoverable - aren't the private keys in that file? Guess I'm not sure how to use this script.

Simple start it and wait. After take the list of privatekeys founded and re-import on another wallet. If you lucky, you take back all your bitcoins.




FaSan

If you open the wallet.dat in notepad the generic line would be like this:
name"ADDRESS here


Is it a vanilla wallet or encrypted?

If it's plain normal wallet.dat then the old wallet can access the new coins. Not sure about encrypted wallets or wallets for tools other than bitcoinQT


Edit:

Other strings in my wallet:
minversion
defaultkey
version
setting
addrIncoming
minversion
defaultkey
version
setting
addrIncoming

Try searching anything related to this:


Kindly,
       MZ

have a look here ....

http://blog.cyplo.net/2012/04/01/bitcoin-wallet-recovery-photorec/

science

I looked at an encrypted wallet using medit and the addresses and labels of addresses at least are there in plain text.

Thanks... but I don't even know my addresses.

I have some not encrypted, but of course my bitcoins are. Are you able to provide a string? Grep's going to pull every document that has those words... that's why I need a string of text.

Thanks! But I have about 20 different coins... I guess I'll have to try and match which key goes to what wallet?

lucky did u ever look at the link i post before?? there u can find the answer


science

Thanks! I'll check this out once I find the files.

I was just about to respond to you :)  I see the link but haven't read it yet. Thanks for providing it :)

import every private key to every wallet. you can import keys using RPC or command line so it shouldn't be too tedious.

Your post history does (only had a quick look):
16K6t4BtQwhbeTBaRrocCuptESyKcXTcuZ
1BUJ92LbERYLEPxfaxcRJECm5rXYasvsxE

Holy smokes! So this will actually rename them to wallet.dats for me... and I can then use Newar's suggestion to peer inside the files to see addresses/labels maybe? Do wallet.dats have the coin name mentioned in them? that could help.

So to use this, it looks like I have to install fidentify? Can I assume that the wallet file extension was also located in the /usr/share/misc/magic directory as well?

Perhaps I should've mentioned that after I copied all files to my external drive, I reinstalled unbuntu... don't ask me why I didn't just take the damn hard drive and confirm the files were there before doing that. Coulda, woulda, shoulda doesn't help me now, it was an oversight, I was tired as hell. Anyhoo, I guess that's why Testdisk couldn't help me and I had to use Photorec.

Nice detective work :)  But those are from my online wallet... This is a new system I built a couple of months ago to start to start hosting pools so I had to download the client.

Holy crap - didn't know this. Man you guys are going to take my bitchange, lol. But it's cool :)

Just so you guys know... I'm going to try everything I can obviously. You guys gave me lots of direction here... so you'll end of splitting the bounty.

So I've already ran Photorec (this is second time around actually - 6 hours left). Do I have to run it again so that the wallet.dat signature file can be included in the recovery? I was under the impression that maybe they'd be in the 1mil files I got on the first run, just perhaps a .txt format....

Didn't you get a backup in the external drive? then just run (assuming you are on ubuntu now)
Against your backed up files, and it will get the wallets for you no matter what their name/extension is.

(And put the real path of the external drive instead of EXTERNAL_DRIVE)

Ah! Yes, Photorec saved all of my copied files over to my external drive. But because they're a default file signature type I was asking whether the wallet files were recovered to begin with. It looks like you have to add a custom signature prior to running Photorec so the files can be included in the recovery:

http://www.cgsecurity.org/wiki/Add_your_own_extension_to_PhotoRec

Hi!


Here are the sig for DB Berkeley (wallet.dat) add it to photorec and run it again...

Science

Sweet! So I do have to run it again... guess I'll go ahead and stop this session. Before I do though, I want to see if FaSan's method of using keyhunter is faster than Photorec. It's been running now for 17hours and says I still have 6 hours left. I'm scanning the entire disk.

EDIT - this might be a stupid question... do all wallets use this signature, or will this only find my bitcoin wallat.dat?

nearly all cryptocoins use the DB Berkeley format

science

How much do you have in those wallets, if you don't mind me asking!

10s of 1000s of a few pretty much worthless coins

Wouldn't you only need the private address? no need for the public one if you have the private one, correct? I hope you are able to find your cons, I know it sucks to lose coins from technical issues.

I have to find the wallet.dat files first! :P  Here's hoping :)  I was able to find a couple of my most precious files... my index.html and style css for my website. Lots of me went into those... they're not the latest iteration, but at least I can work from that. Tomorrow I'll work on the wallet.dats.

Try checking history of your browser. Somehow if you checked your balance of an address in blockchain or any other exploerer, you might get it from browser.

Kindly,
      MZ

Another option, if you have Linux/Cygwin/(probably)OSX, you can search through all of the extensionless files recovered by Photorec and use the `file` command to determine the type. Wallet files appear as "Berkeley DB (Btree, version 9, little-endian)", and so you should be able to find it relatively easily by running something like `file ** | grep "Berkeley DB"` (if you have globstar enabled, though there are many other ways of recursively searching every file within a specified location). You can use this technique for other file types as well, though anything plaintext will simply show up as "ASCII text" so it'll only help for binary file types with a specific identifier such as PNG (though presumably Photorec handles much of this, given the name).

Yeah actually that's a very good idea.

And you can simply do (without globstar)
(And replace ./ with the directory path)

Did you already get your wallet data back?
I had this problem as well, using a simple recovery tool. Anything should work really.
I hope you get yours back!

Try Recuva recovery software and search for wallet.dat or just type .dat you can search it in specific participation, you can also search for any other format you need for.

I think I tried that - I think it's only for Windows. But even so, the majority of the files I recovered extension was renamed to .txt.

Thanks! I haven't yet, but here's hoping!

Sweet!!! Will try this next :)

I'm getting this error back:

find: missing argument to '-exec'  I guess something's missing from the line?

If you copy pasted it properly shouldn't have any problems..

You probably need to escape the braces, like this: