|
Title: How to recover btc after windows reinstall Post by: morbius55 on June 24, 2017, 12:39:04 PM Can anyone point me to a guide on using pywallet or a recovery program to attempt getting my btc back from a hard drive that has had windows reinstalled. The drive was removed from the laptop and was used for less than a week after the stupid event. I have bought a hard drive caddy but want to know if i should use a recovery program or can i just use pywallet?. If anyone could point me to a guide that is useable by a computer novice, ie a step by step spoon feed type guide, i would be very grateful. Cheers guys.
Title: Re: How to recover btc after windows reinstall Post by: Lauda on June 24, 2017, 01:10:15 PM You need a wallet file to use pywallet. It alone, without such a file, is useless. If the drive was overwritten then the chance of recovery is very slim.
For attempting to recover, try one of these: EaseUs (https://www.easeus.com/partition-recovery/) Recuve (https://www.piriform.com/recuva) Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 24, 2017, 01:26:42 PM You need a wallet file to use pywallet. It alone, without such a file, is useless. If the drive was overwritten then the chance of recovery is very slim. Thanks for your reply. So the first step would be to search for wallet.dat? using a recovery program, how could i distinguish between ltc, qrk and btc data?. I have to try whatever it takes as we are talking about maybe 32btc plus some ltc. cheers. :'(For attempting to recover, try one of these: EaseUs (https://www.easeus.com/partition-recovery/) Recuve (https://www.piriform.com/recuva) Title: Re: How to recover btc after windows reinstall Post by: Lauda on June 24, 2017, 01:30:59 PM Thanks for your reply. So the first step would be to search for wallet.dat? using a recovery program, how could i distinguish between ltc, qrk and btc data?. They are all named 'wallet.dat', thus I don't believe that you could distinguish unless there is a leftover path. If you recover any wallet.dat file, back it up and throw it into a client(s) to test which it is.I have to try whatever it takes as we are talking about maybe 32btc plus some ltc. cheers. :'( 32 BTC and:1) Using Windows. 2) Keeping all funds at one machine. 3) Having no other backups. These are some of the worst security practices that I've seen. Good luck with the recovery. Title: Re: How to recover btc after windows reinstall Post by: HCP on June 24, 2017, 01:58:36 PM pywallet also has a recovery mode for attempting to find deleted wallet files... whether or not it is able to find anything after the drive has been formatted and had the OS reinstalled is another story...
Read more here: https://bitcointalk.org/index.php?topic=38004.0 Title: Re: How to recover btc after windows reinstall Post by: felco on June 24, 2017, 02:44:20 PM Can anyone point me to a guide on using pywallet or a recovery program to attempt getting my btc back from a hard drive that has had windows reinstalled. The drive was removed from the laptop and was used for less than a week after the stupid event. I have bought a hard drive caddy but want to know if i should use a recovery program or can i just use pywallet?. If anyone could point me to a guide that is useable by a computer novice, ie a step by step spoon feed type guide, i would be very grateful. Cheers guys. -- If you have the HDD, I would recommend one piece of software that I have used before(Though not recover DBase Files, that is the kind of file for wallet.dat), here the link: http://www.cgsecurity.org/wiki/TestDisk_Download The software you want to use is PhotoRec. I would give it a shot. Just remember to save the recovered files in another drive, not the one you are scanning. Good Luck! Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 24, 2017, 03:39:26 PM Can anyone point me to a guide on using pywallet or a recovery program to attempt getting my btc back from a hard drive that has had windows reinstalled. The drive was removed from the laptop and was used for less than a week after the stupid event. I have bought a hard drive caddy but want to know if i should use a recovery program or can i just use pywallet?. If anyone could point me to a guide that is useable by a computer novice, ie a step by step spoon feed type guide, i would be very grateful. Cheers guys. -- If you have the HDD, I would recommend one piece of software that I have used before(Though not recover DBase Files, that is the kind of file for wallet.dat), here the link: http://www.cgsecurity.org/wiki/TestDisk_Download The software you want to use is PhotoRec. I would give it a shot. Just remember to save the recovered files in another drive, not the one you are scanning. Good Luck! Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 25, 2017, 10:46:48 AM Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks.
Title: Re: How to recover btc after windows reinstall Post by: ranochigo on June 25, 2017, 10:50:52 AM Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks. You should search the place where your data directory is stored at. By default, it is at %appdata%/Bitcoin.If you changed the data directory, you have to specify it. Title: Re: How to recover btc after windows reinstall Post by: SopaXT on June 25, 2017, 11:57:22 AM Which wallet were you using?
Nobody has asked this, so I think I should. Was it Core? pywallet only works with Core wallets. If not, there's still a chance, maybe you can contact a bitcoin recovery service. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 25, 2017, 11:59:17 AM Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks. You should search the place where your data directory is stored at. By default, it is at %appdata%/Bitcoin.If you changed the data directory, you have to specify it. Title: Re: How to recover btc after windows reinstall Post by: ranochigo on June 25, 2017, 12:26:56 PM So what would the exact file address be Users\Username\Apps\Roaming\Bitcoin\??, any help welcome. Quote C:\Documents and Settings\YourUserName\Application data\Bitcoin (XP) C:\Users\YourUserName\Appdata\Roaming\Bitcoin (Vista and 7) Also, what would a private key typically look like compared with a public key. Thanks. A private key typically starts with a L, K or 5 for wallet import format.It doesn't really matter. You are going to need look for file name that is wallet.dat or anything that ends with .dat. The wallet.dat is not in a human readable format so you likely cannot use that to search for it. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 25, 2017, 12:41:31 PM Would i see private keys in wallet import format assuming i find any private keys on the drive, and are they always the same length of characters?. thanks again.
Title: Re: How to recover btc after windows reinstall Post by: khufuking on June 25, 2017, 12:44:29 PM Which wallet were you using? I know that the wallet was installed i think in 2013 so assuming it is core?. Thanks.Nobody has asked this, so I think I should. Was it Core? pywallet only works with Core wallets. If not, there's still a chance, maybe you can contact a bitcoin recovery service. Title: Re: How to recover btc after windows reinstall Post by: LoyceV on June 25, 2017, 12:49:40 PM Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? No offense, but if this is the level of questions you're asking while searching to recover $84k, I'd say STOP IT NOW and hire a professional data recovery service.Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 25, 2017, 01:00:43 PM Are public keys 33 characters long and private keys 51 characters long always?. Thanks.
Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 25, 2017, 01:07:17 PM Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? No offense, but if this is the level of questions you're asking while searching to recover $84k, I'd say STOP IT NOW and hire a professional data recovery service.Title: Re: How to recover btc after windows reinstall Post by: Gamepakhsh on June 25, 2017, 01:21:29 PM try
https://www.easeus.com/partition-recovery/ Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 25, 2017, 06:08:34 PM Will a private key show as a 51 character string starting with 5, or will it be in another form?, when searching the hdd. Thanks.
Title: Re: How to recover btc after windows reinstall Post by: HCP on June 26, 2017, 01:28:54 AM Generally, most wallet files will encrypt the private keys... and they'll be stored in possibly binary or hex format. Attempting to identify them simply by scanning bytes on the harddrive is going to be like looking for a needle in a stack of needles. :-\
Title: Re: How to recover btc after windows reinstall Post by: Casy on June 26, 2017, 12:28:03 PM Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? and what file path should i search rather than the whole hdd. Thanks. You could search in the app data dir of the user that was logged in. Alternatively, if you have a second hdd you could restore all the discovered files of recuva to that second hdd and scan for your wallet within these files afterwards. It's probably the better way as the more you do on your current hdd, the more likely it is that you overwrite your wallet permanently. Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on June 26, 2017, 02:35:07 PM There are instructions for setting pywallet up in this post. However the post was made in 2015 and I don't know if all the download links for the dependencies work any more.
https://bitcointalk.org/index.php?topic=1288078.msg13238007#msg13238007 Also achow101 says the wallet.dat format changed, and pywallet struggles to work on the new format. I can't say what format your wallet.dat would be because I think the change of format was in 2013 when you say your brother installed his Bitcoin software. The Bitcoin Core wallet structure has changed since pywallet was last updated so pywallet will not work very well with new wallets. I suggest that you use Bitcoin Core's dumpwallet console command to get all of your private keys instead of a 3rd party tool. Title: Re: How to recover btc after windows reinstall Post by: xFiber on June 26, 2017, 03:27:16 PM 32 Bitcoin is not nothing so I'd rather spent a 100$ to get it done porfessionally and ultimately get 84K rather than messing with it myself. I advise you to not mess a lot with it man. Get it done professionally and hopefully you can enjoy your treasure :D
Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on June 26, 2017, 04:12:28 PM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was.
There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https://sourceforge.net/projects/wxhexeditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://i.imgur.com/p77Eyja.png Click "edit", then "find". https://i.imgur.com/IkAmEMY.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://i.imgur.com/Yufvs5K.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Title: Re: How to recover btc after windows reinstall Post by: Casy on June 26, 2017, 08:09:10 PM Wow, nice and detailed explanation HI-TEC99, thumbs up for this.
Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 26, 2017, 08:36:12 PM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. Thanks, really appreciate this. Probably last chance saloon if my attempt with Recuva is anything to go by.There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://s18.postimg.org/bgx26fz89/unconfirmed.png Click "edit", then "find". https://s17.postimg.org/ex1mslabz/unconfirmed.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://s1.postimg.org/kljg03w6n/unconfirmed.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. I do have the password, but don't know whether the wallet was locked the last time it was used. If this doesn't find anything then would pywallet be able to scan the whole drive?. Thanks again, and to anyone else that has given helpful comments. :) Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on June 26, 2017, 08:51:58 PM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. Thanks, really appreciate this. Probably last chance saloon if my attempt with Recuva is anything to go by.There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://s18.postimg.org/bgx26fz89/unconfirmed.png Click "edit", then "find". https://s17.postimg.org/ex1mslabz/unconfirmed.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://s1.postimg.org/kljg03w6n/unconfirmed.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. I do have the password, but don't know whether the wallet was locked the last time it was used. If this doesn't find anything then would pywallet be able to scan the whole drive?. Thanks again, and to anyone else that has given helpful comments. :) Yes pywallet can scan a whole drive for a deleted wallet.dat. However, it's very old software and getting it working requires installing some very old versions of other software that can be difficult to find. I played around with it about half a year ago and had it working, but I can't remember all the steps I made. I'll have to test reinstalling it to work out some instructions. Hopefully achow101's installation instructions from 2015 still work. This is a screenshot of pywallet scanning a drive. https://i.imgur.com/q0AhO3m.png Title: Re: How to recover btc after windows reinstall Post by: |Bitkoin| on June 26, 2017, 10:00:33 PM Take this with a grain of salt, but consider contacting your local police department. Inform them you lost $100,000 worth of Bitcoins. If they have forensic experts able to recover it, you will donate $20,000 to the department for their services. It is worth a shot at least.
P.S. If it works, I wouldn't mind a small donation either. :) Title: Re: How to recover btc after windows reinstall Post by: shield132 on June 26, 2017, 11:22:41 PM What about to don't damage your hdd more and try to get help from professionals? 32 btc isn't joke and especially when price is so high. https://www.securedatarecovery.com/services
Can't see that this is so big problem despite the facts which you wrote. I had many moments when I repaired files what I needed. And recuva isn't your last chanse, try more serious services. Title: Re: How to recover btc after windows reinstall Post by: jekjekman on June 27, 2017, 06:15:57 AM I once read an article about this that you can recover your files in your HDD even though it is reformatted with a specific software to be use, until it has no bad secter or error. installing a new OS to your HDD can partition it and also wipe out it's data
or simply follow this guide, I hope this could help you https://www.easeus.com/resource/recover-data-after-format.htm Title: Re: How to recover btc after windows reinstall Post by: autistaorange on June 27, 2017, 08:12:38 AM In the passed, when i've installed windows it would leave your old files intact somewhere (unless you specified to nuke them by reformatting your drive).
Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 27, 2017, 06:29:40 PM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. Does that sequence always occur before every private key in your experience?. Thanks again.There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://s18.postimg.org/bgx26fz89/unconfirmed.png Click "edit", then "find". https://s17.postimg.org/ex1mslabz/unconfirmed.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://s1.postimg.org/kljg03w6n/unconfirmed.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. [/quote] Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on June 27, 2017, 09:07:04 PM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. Does that sequence always occur before every private key in your experience?. Thanks again.There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https://sourceforge.net/projects/wxhexeditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://i.imgur.com/p77Eyja.png Click "edit", then "find". https://i.imgur.com/IkAmEMY.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://i.imgur.com/Yufvs5K.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Someone else did some testing and found that sequence before every key he tested. I also tested it and came to the same conclusion. However it might not always work. Another sequence you can try searching for is 01036B65794104. If you find it and also find the sequence 0420 about 180 bytes later, then the next thirty-two bytes are probably a private key. This quote explains it in more detail. If you know how to use a hex editor you could try scanning your drive for this sequence of bytes: 01 03 6B 65 79 41 04. That sequence often occurs in a wallet.dat file about 180 bytes before a private key. If you look forward 180 bytes and can find the byte sequence 04 20 then it's likely a private key is the next the thirty-two bytes. If you find a private key you can change it to a common format by pasting the thirty-two bytes into an offline copy of this webpage. https://www.bitaddress.org/ This is an example of the 32 bytes of a private key in notepad. Quote https://i.imgur.com/EYQ16mY.png This is the private key copied from notepad and pasted into an offline copy of the bitaddress website. Click the view details button to get the private key converted to normal formats. https://i.imgur.com/25LbcRn.png There's a more detailed explanation of the byte sequences to search for in this quote. I have been doing some tinkering around, thinking about other people's wallet disasters, and believe I have come to the following conclusion... If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer. If so, recovery is no longer purely theoretical. With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable. So here goes... If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence: 01 03 6B 65 79 41 04........... the middle four of these bytes represent the string "keyA" in ASCII. Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later. The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s). Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex). These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes). If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins! Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find. Carefully search the sectors adjacent to any sector containing the "keyA" sequence above. Then yell for help! (But don't share the private keys in public, unless you want to give away your wallet.) An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex. In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan. Scanning a full disk can take hours. WinHex must "run as administrator" to be able to scan a physical disk. Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible. Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 29, 2017, 04:23:23 PM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. Does that sequence always occur before every private key in your experience?. Thanks again.There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://s18.postimg.org/bgx26fz89/unconfirmed.png Click "edit", then "find". https://s17.postimg.org/ex1mslabz/unconfirmed.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://s1.postimg.org/kljg03w6n/unconfirmed.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Someone else did some testing and found that sequence before every key he tested. I also tested it and came to the same conclusion. However it might not always work. Another sequence you can try searching for is 01036B65794104. If you find it and also find the sequence 0420 about 180 bytes later, then the next thirty-two bytes are probably a private key. This quote explains it in more detail. If you know how to use a hex editor you could try scanning your drive for this sequence of bytes: 01 03 6B 65 79 41 04. That sequence often occurs in a wallet.dat file about 180 bytes before a private key. If you look forward 180 bytes and can find the byte sequence 04 20 then it's likely a private key is the next the thirty-two bytes. If you find a private key you can change it to a common format by pasting the thirty-two bytes into an offline copy of this webpage. https://www.bitaddress.org/ This is an example of the 32 bytes of a private key in botepad. Quote https://s3.postimg.org/4ze7slolv/image.png This is the private key copied from notepad and pasted into an offline copy of the bitaddress website. Click the view details button to get the private key converted to normal formats. https://s23.postimg.org/r2utminaj/image.png There's a more detailed explanation of the byte sequences to search for in this quote. I have been doing some tinkering around, thinking about other people's wallet disasters, and believe I have come to the following conclusion... If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer. If so, recovery is no longer purely theoretical. With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable. So here goes... If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence: 01 03 6B 65 79 41 04........... the middle four of these bytes represent the string "keyA" in ASCII. Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later. The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s). Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex). These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes). If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins! Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find. Carefully search the sectors adjacent to any sector containing the "keyA" sequence above. Then yell for help! (But don't share the private keys in public, unless you want to give away your wallet.) An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex. In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan. Scanning a full disk can take hours. WinHex must "run as administrator" to be able to scan a physical disk. Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible. Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary. Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on June 29, 2017, 10:08:55 PM Sorry to bug you again but when i start hex editor, the drive letter doesn't appear, only drive D. Thanks. Are you trying to scan an external drive or your internal one with your operating system running on it? It should already be able to see all your external hard drives. By default it only scans external drives like the type you plug into a USB port. I only recommend running it inside a vmware or virtual box virtual machine in case there is anything malicious hidden in it. I wouldn't ever risk searching for private keys in plain text while running it on my internet connected operating system. If you can't see a particular external hard drive with it then you could try running it with administrative privileges in windows, or as root in linux. However if you risk doing that you must definitely run the hex editor inside a virtual machine for safety. If you give it administrative privileges or make it root then you are giving it control of your operating system, and that's a big security risk. Also, it will be able to open your drive running your operating system which will probably show as physicaldrive0. If you edit the hex on that drive you could crash your operating system. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on June 29, 2017, 10:29:35 PM Sorry to bug you again but when i start hex editor, the drive letter doesn't appear, only drive D. Thanks. Are you trying to scan an external drive or your internal one with your operating system running on it? It should already be able to see all your external hard drives. By default it only scans external drives like the type you plug into a USB port. I only recommend running it inside a vmware or virtual box virtual machine in case there is anything malicious hidden in it. I wouldn't ever risk searching for private keys in plain text while running it on my internet connected operating system. If you can't see a particular external hard drive with it then you could try running it with administrative privileges in windows, or as root in linux. However if you risk doing that you must definitely run the hex editor inside a virtual machine for safety. If you give it administrative privileges or make it root then you are giving it control of your operating system, and that's a big security risk. Also, it will be able to open your drive running your operating system which will probably show as physicaldrive0. If you edit the hex on that drive you could crash your operating system. Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 02, 2017, 04:32:52 PM Searched using the sequence 0201010420 and didn't get any matches, but i will try the other sequence when i get chance. I briefly searched the 0420 sequence but as i thought, after 30 mins there were already some 40000 results. Can i ask a really basic question?, if there were 32 bitcoins in the account, does that mean 32 private keys?. Thanks again. No, it depends on how many Bitcoins were sent to each address. All 32 Bitcoins could have been sent to the same address, in which case claiming those coins would only require one private key. If 16 Bitcoins were sent to one address and the other 16 were sent to a different address claiming those coins would only require two private keys. Maybe using pywallet would give better results. It can scan for password protected wallets and earlier on you said you have the password. However, pywallet's not easy to install as it's very old software. Title: Re: How to recover btc after windows reinstall Post by: Vixmore on July 06, 2017, 10:42:48 AM Can anyone point me to a guide on using pywallet or a recovery program to attempt getting my btc back from a hard drive that has had windows reinstalled. The drive was removed from the laptop and was used for less than a week after the stupid event. I have bought a hard drive caddy but want to know if i should use a recovery program or can i just use pywallet?. If anyone could point me to a guide that is useable by a computer novice, ie a step by step spoon feed type guide, i would be very grateful. Cheers guys. Try using a recovery program, that might work. Try looking for the pywallet files in your windows.old folder. There should be one like that in your C:/ or D:/ drive. Or an alternate way is to go into your "restore version" of windows and try to see if there are any restore points that you can choose. If yes, let it restore and copy all the necessary files, then undo the restore. If you cannot do this, try to see if you can get a restore program that will get back your old windows version and pywallet. Visit this link, http://www.jihosoft.com/recover-data/data-recovery-after-windows-reinstall.html Might work. I know that it is possible, although it may vary on how much you cleaned your drive. My father did it somehow, ill get back to you once I ask. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 09, 2017, 10:07:08 PM I ran a different recovery program and it found wallet.dat folder 96kb, a chainstate folder and a blocks folder. When it had found these folders it classed them as in good condition yet the wallet dat folder is only 96kb? can that be right.
If someone else had accessed this file and removed any keys would that reduce it to 96kb. Thanks. Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 09, 2017, 10:13:21 PM I ran a different recovery program and it found wallet.dat folder 96kb, a chainstate folder and a blocks folder. When it had found these folders it classed them as in good condition yet the wallet dat folder is only 96kb? can that be right. If someone else had accessed this file and removed any keys would that reduce it to 96kb. Thanks. That sounds exactly right. I tested generating a wallet.dat with a very old version of Bitcoin core and it was 96KB. Make some backups of it then test it to find out if it's not corrupted. Have you tried opening the wallet.dat from inside Bitcoin core yet? You don't need to sync Bitcoin core to find out if the wallet isn't corrupted. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 09, 2017, 10:16:34 PM I ran a different recovery program and it found wallet.dat folder 96kb, a chainstate folder and a blocks folder. When it had found these folders it classed them as in good condition yet the wallet dat folder is only 96kb? can that be right. If someone else had accessed this file and removed any keys would that reduce it to 96kb. Thanks. That sounds exactly right. I tested generating a wallet.dat with a very old version of Bitcoin core and it was 96KB. Make some backups of it then test it to find out if it's not corrupted. Have you tried opening the wallet.dat from inside Bitcoin core yet? You don't need to sync Bitcoin core to find out if the wallet isn't corrupted. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 09, 2017, 10:25:16 PM Which Bitcoin wallet should I download? to give it a try. thanks.
Title: Re: How to recover btc after windows reinstall Post by: HCP on July 09, 2017, 11:29:24 PM Wallet.dat files only work with Bitcoin Core. As far as I know, no other wallet application works with this file format. There is also the pywallet script that supposedly works with wallet.dat files, but I've found that it is a little outdated and doesn't play nicely with newer versions of wallet.dat files from newer versions of Bitcoin Core.
As HITEC suggested, I'd make a few backup copies of what you have recovered... then, grab a copy of Bitcoin Core... depending on how old your copy of Core was... you can find all the history releases here: https://bitcoin.org/bin/ I'd probably start with 0.14.x and work backwards until you find a version that works with the wallet.dat you have. I think the newer versions will read and "upgrade" older versions, (hence why you might want to make multiple backup copies) but I'm not 100% on that. Otherwise, check out Pywallet (https://bitcointalk.org/index.php?topic=34028.0) and see if that works with the wallet.dat Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 10, 2017, 12:02:37 AM Which Bitcoin wallet should I download? to give it a try. thanks. That depends on what version of Bitcoin core created the wallet.dat file. You said you think it was installed in 2013. The file format used in wallet.dat files changed in version 0.8, and that version was first available in early 2013. I know that the wallet was installed i think in 2013 so assuming it is core?. Thanks. If a version after 0.8 created your wallet.dat file then the version of Bitcoin core available at this link should be able to open it. https://bitcoin.org/en/download Like HCP says, first check if the latest version from that link can open your wallet.dat file. If you have to try using very old versions DON'T run them on an internet connected computer. Run them offline inside a virtual machine created by virtual box or vmware. Bitcoin.org gives this warning about the very old versions it provides. https://bitcoin.org/bin/insecure/README.txt Quote The releases in this directory contain known security flaws and should not be used. If you need to try a version from before 0.8 you can find one here. However, the same security precautions apply. Run it offline inside a virtual machine. http://eligius.st/~luke-jr/programs/bitcoin/files/bitcoin-qt/0.7.3/test/rc3/ Title: Re: How to recover btc after windows reinstall Post by: achow101 on July 10, 2017, 05:44:35 AM That depends on what version of Bitcoin core created the wallet.dat file. You said you think it was installed in 2013. The file format used in wallet.dat files changed in version 0.8, and that version was first available in early 2013. The latest versions Core will be able to read any previous wallet format. The wallet format is forwards compatible (something created in the past can be read by stuff made later) but not backwards compatible (something created now may not work on previous versions).Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 10, 2017, 10:00:36 AM That depends on what version of Bitcoin core created the wallet.dat file. You said you think it was installed in 2013. The file format used in wallet.dat files changed in version 0.8, and that version was first available in early 2013. The latest versions Core will be able to read any previous wallet format. The wallet format is forwards compatible (something created in the past can be read by stuff made later) but not backwards compatible (something created now may not work on previous versions).Doh! Thanks for pointing that out. I should have tested it before opening my big mouth. I just tried creating a wallet.dar with version 0.7.0, then opening it with the latest version and it worked. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 10, 2017, 04:02:32 PM So to summarise, download latest bitcoin core.
delete wallet.dat from it. Replace with my recovered wallet .dat. Start bitcoin core. Cross everything. Is that correct?. Thanks and sorry for novice questions. Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 10, 2017, 05:21:02 PM So to summarise, download latest bitcoin core. delete wallet.dat from it. Replace with my recovered wallet .dat. Start bitcoin core. Cross everything. Is that correct?. Thanks and sorry for novice questions. Yes, the wallet.dat should be placed in the folder named Bitcoin that's inside the appdata folder. These instructions explain how to open it if you don't know how to do it. Click the windows start button, then copy and paste the line of text below into the search box that appears, then press the enter key to open the hidden folder containing your Bitcoin wallet.dat file. %appdata%\Bitcoin This is what your search box should look like after you have copied and pasted the line above into it. https://s21.postimg.org/91dnzi7w7/unconfirmed.png Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 10, 2017, 09:19:30 PM Does salvage wallet run automatically in latest Bitcoin core?.
It's looking like I need to figure out how to setup and use Pywallet. Title: Re: How to recover btc after windows reinstall Post by: HCP on July 11, 2017, 03:55:21 AM Does salvage wallet run automatically in latest Bitcoin core?. I take it that this means that Bitcoin Core was unable to read the recovered wallet.dat file that you attempted to import? Did you get any errors... or did it just come up with a zero balance? If it came up with a zero balance, it is highly likely that this was just an empty wallet that had been generated by an earlier installation of Bitcoin Core but was never used.It's looking like I need to figure out how to setup and use Pywallet. If you got errors, can you post the debug.log from when you attempted to load the recovered wallet.dat. NOTE: Please use pastebin.com (https://pastebin.com/) for this and just post the pastebin link! ;) Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 11, 2017, 06:21:31 PM Does salvage wallet run automatically in latest Bitcoin core?. I take it that this means that Bitcoin Core was unable to read the recovered wallet.dat file that you attempted to import? Did you get any errors... or did it just come up with a zero balance? If it came up with a zero balance, it is highly likely that this was just an empty wallet that had been generated by an earlier installation of Bitcoin Core but was never used.It's looking like I need to figure out how to setup and use Pywallet. If you got errors, can you post the debug.log from when you attempted to load the recovered wallet.dat. NOTE: Please use pastebin.com (https://pastebin.com/) for this and just post the pastebin link! ;) https://pastebin.com/tCbE7E2C Title: Re: How to recover btc after windows reinstall Post by: HCP on July 12, 2017, 03:59:43 AM Can you also post the db.log file as well? It seems like the recovered wallet.dat is corrupt. The "can't rename" error you see in the debug.log seems to be indicative of an issue during the parsing of the wallet by the DB functions.
Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 12, 2017, 05:56:39 AM Hopefully done this right, never used pastebin before. https://pastebin.com/tCbE7E2C Is that log the result of opening the wallet.dat in core, or the result of using the salvagewallet option on it? The "can't rename" error often occurs when using the salvagewallet option. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 12, 2017, 05:59:45 AM Hopefully done this right, never used pastebin before. https://pastebin.com/tCbE7E2C Is that log the result of opening the wallet.dat in core, or the result of using the salvagewallet option on it? The "can't rename" error often occurs when using the salvagewallet option. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 12, 2017, 06:04:40 AM https://pastebin.com/aGgzCWk9
Title: Re: How to recover btc after windows reinstall Post by: BitcSeo on July 12, 2017, 08:51:24 AM Just had a preliminary search of the drive using recuva but only let it run for 15 minutes before it was indicating that it had found 10's of thousands of files. Why so many? No offense, but if this is the level of questions you're asking while searching to recover $84k, I'd say STOP IT NOW and hire a professional data recovery service.i wanted to make same suggestion to morbius55, because i've notice some incompetency from most of the question(s) above. data restoration,back-up are not task mean't for basic computer user's. And, if, you are advance computer user's you should be familiar with a specific recovery tool because what seem to be user-friendly for mr A will not be for mr B. ☞Whichever, i suggest you hire an expert, who is competent enough to recover those coin otherwise you stand the risk of losing all should in case thing's go wrong. Goodluck Bitcseo Title: Re: How to recover btc after windows reinstall Post by: HCP on July 13, 2017, 12:28:44 AM https://pastebin.com/aGgzCWk9 Looks like that recovered wallet.dat file is indeed corrupted so that Bitcoin Core is now unable to open it... have you tried with the -salvagewallet option?If that does not work, then your only other option would be attempting to use pywallet (https://bitcointalk.org/index.php?topic=34028.0) to at least retrieve some private keys from the wallet.dat file. Another user had a similar issue with a corrupted file after recovery here: https://bitcointalk.org/index.php?topic=2012533.0 Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 13, 2017, 05:13:42 PM Do I run salvagewallet from the shortcut I created for Bitcoin Qt by opening properties then typing salvagewallet after exe leaving a space first, then hit apply and okay?.
Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 13, 2017, 05:51:44 PM Doesn't even seem to try to salvage. :(
Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 13, 2017, 07:39:25 PM After salvage attempt. https://pastebin.com/30PXfJmR
Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 13, 2017, 07:41:16 PM db log. https://pastebin.com/WcRVA5E0
Title: Re: How to recover btc after windows reinstall Post by: HCP on July 14, 2017, 05:54:51 AM You realise you can just "edit" your previous post right? There is no need to create 3 posts in a row... ;)
Do I run salvagewallet from the shortcut I created for Bitcoin Qt by opening properties then typing salvagewallet after exe leaving a space first, then hit apply and okay?. I believe it should be: -salvagewalletSo your shortcut should look like this: https://talkimg.com/images/2023/11/15/z0u2j.png If you managed to get the -salvagewallet option working OK and that is the output you're getting then it would seem that the wallet file that was recovered was totally corrupted... :-\ At this point maybe pywallet is likely to be your best option. Title: Re: How to recover btc after windows reinstall Post by: BTCwoker on July 14, 2017, 11:24:39 AM you just need to a place where your data is stored. by default, it is %appdata%/Bitcoin. you need to itemize it in the case of changing data directory.
Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 15, 2017, 05:57:04 PM I have tried another recovered wallet.dat file and it hasn't crashed. If there are some coins in it, how long would they take to show up. Thanks.
Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 15, 2017, 06:01:31 PM I have tried another recovered wallet.dat file and it hasn't crashed. If there are some coins in it, how long would they take to show up. Thanks. It could take a long time, you have to wait for core to sync before you can see balances. Check all the addresses that core shows in a block explorer like this one. If an address contains coins the block explorer will immediately tell you. https://blockchain.info/ Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 15, 2017, 06:14:22 PM I have tried another recovered wallet.dat file and it hasn't crashed. If there are some coins in it, how long would they take to show up. Thanks. It could take a long time, you have to wait for core to sync before you can see balances. Check all the addresses that core shows in a block explorer like this one. If an address contains coins the block explorer will immediately tell you. https://blockchain.info/ Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 15, 2017, 06:24:21 PM I have tried another recovered wallet.dat file and it hasn't crashed. If there are some coins in it, how long would they take to show up. Thanks. It could take a long time, you have to wait for core to sync before you can see balances. Check all the addresses that core shows in a block explorer like this one. If an address contains coins the block explorer will immediately tell you. https://blockchain.info/ Bitcoin.org recommends having 145 GB of spare HD space. Which folder did you rename to wallet.dat2? By default Bitcoin core looks for a wallet.dat file in a folder named Bitcoin that's inside a hidden folder named appdata. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 15, 2017, 06:30:08 PM Trouble is that it by default places the Bitcoin folder in c which is 250GB and there is only 70GB of space left. I copied the second wallet dat file onto the same usb stick as the first i recovered and had to name it differently.
Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 15, 2017, 06:38:09 PM Trouble is that it by default places the Bitcoin folder in c which is 250GB and there is only 70GB of space left. I copied the second wallet dat file onto the same usb stick as the first i recovered and had to name it differently. If you don't have enough hard drive space try extracting your private keys from Bitcoin core, installing the electrum wallet, then importing the private keys into it. These instructions explain how to do it. Search for all the Bitcoin addresses that Bitcoin-QT shows on this website. That site will tell you if an address contains Bitcoins. http://blockchain.info/ To view the addresses in Bitcoin-QT click "file" in the menu, then click "receiving addresses" in the drop down list that appears. https://i.imgur.com/d9SCaSr.png If blockchain.info shows an address contains coins you can either wait for up to a week for Bitcoin-QT to sync, or use a different wallet to spend them immediately. If you want fast access to your Bitcoins you need to extract their private keys from Bitcoin-QT, then import those private keys into alternative wallet software like electrum. To extract the private keys click "help" in the Bitcoin-QT menu, then click "debug window" in the drop down list that appears. https://i.imgur.com/7lbgqUq.png Click the tab labelled "console" in the debug window that appears. https://i.imgur.com/egPCWMj.png Type dumpprivkey, then a space, then your Bitcoin address in the text box at the bottom of the console window. This is an example. dumpprivkey 1Cgu5PQyTYrZn4VtAs2T1FHf1ayXVYHNDt https://i.imgur.com/JFIVUkY.png Afterwards press your enter key to view the private key for your Bitcoin address. There's an example private key (L4RY4tv1Qpr4FVxtSLnr7vJiUCvk7A7C2Cd6M7QSU2BkRtj9vhnd) shown in the screenshot. https://i.imgur.com/VnCzT64.png Copy the private key, then download and install the electrum wallet from here. https://electrum.org/#download After installing electrum you can either import or sweep your private keys into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 15, 2017, 06:45:21 PM I have just copied and pasted the receiving address into blockchain info and it didn't show any coins or transactions to that address :(
Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 15, 2017, 06:51:46 PM I have just copied and pasted the receiving address into blockchain info and it didn't show any coins or transactions to that address :( Is there only one receiving address showing in the window that opens when you click file, then receiving addresses? If blockchain.info shows an address doesn't contain coins then it's almost certain the address is empty. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 15, 2017, 06:55:28 PM I have just copied and pasted the receiving address into blockchain info and it didn't show any coins or transactions to that address :( Is there only one receiving address showing in the window that opens when you click file, then receiving addresses? If blockchain.info shows an address doesn't contain coins then it's almost certain the address is empty. Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 15, 2017, 07:12:13 PM I have just copied and pasted the receiving address into blockchain info and it didn't show any coins or transactions to that address :( Is there only one receiving address showing in the window that opens when you click file, then receiving addresses? If blockchain.info shows an address doesn't contain coins then it's almost certain the address is empty. Bitcoin core should show all the receiving addresses generated in a wallet.dat file before it has synced. This is what an example receiving addresses window looks like in an unsynced Bitcoin core. https://i.imgur.com/deeUPVa.png Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 16, 2017, 03:08:41 PM I know it's a big ask but could anyone post a guide on installing pywallet from scratch for a novice computer user including screenshots?.
It seems to me that a lot of people could do with a guide that is easy to follow and once one is posted it could help a lot of people, based on all the posts relating to corrupt wallets etc. Title: Re: How to recover btc after windows reinstall Post by: javeed1 on July 17, 2017, 06:18:05 PM When we need to recover btc after windows reinstall,Electrum wallet generation seeds give you a 12 word phrase of password (order is important).when we clean and reinstall we put this phrase we got it our previous wallet. :D
Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 18, 2017, 05:43:22 PM Just ran dumprivkey in console with the one receiving address and it has shown a key beginning with k, would that be anything of interest?. That's a Private Key in WIF Compressed format. You can import or sweep it into a wallet like electrum to spend any coins associated with it. These are the instructions explaining how to do it. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Sweeping's probably better than importing, but it doesn't really matter which technique you use. You can download electrum from here. https://electrum.org/#download Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 18, 2017, 05:46:36 PM Just in case anything messes up can I download and run electrum with core still running and console open etc?
Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 18, 2017, 05:52:08 PM Just in case anything messes up can I download and run electrum with core still running and console open etc? Yes, running electrum at the same time as core shouldn't be a problem. Before importing your key into electrum I recommend searching for its associated Bitcoin address here. If blockchain.info shows no funds in that address then there's not much point importing it into electrum. https://blockchain.info/ Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 18, 2017, 06:16:43 PM Just in case anything messes up can I download and run electrum with core still running and console open etc? Yes, running electrum at the same time as core shouldn't be a problem. Before importing your key into electrum I recommend searching for its associated Bitcoin address here. If blockchain.info shows no funds in that address then there's not much point importing it into electrum. https://blockchain.info/ Title: Re: How to recover btc after windows reinstall Post by: HI-TEC99 on July 18, 2017, 06:23:02 PM Just in case anything messes up can I download and run electrum with core still running and console open etc? Yes, running electrum at the same time as core shouldn't be a problem. Before importing your key into electrum I recommend searching for its associated Bitcoin address here. If blockchain.info shows no funds in that address then there's not much point importing it into electrum. https://blockchain.info/ I'm not very familiar with Bitcoin core, there are people here much better qualified than me to answer questions about it. However, i think there's some kind of bug affecting the salvagewallet command, and that creates BAK files. I don't know how to fix the problem though. https://github.com/bitcoin/bitcoin/issues/7463 Title: Re: How to recover btc after windows reinstall Post by: ikezar on July 18, 2017, 07:30:49 PM I suggest looking into Disk Drill by Cleverfiles, I have successfully used that tool to recover files deleted and from drives that have been re-partitioned. Wallet files are small enough you can recover anything the approximate right size you find for free with the trial version.
For clarity, in this recovery attempt you are only reading from the drive in question correct? Not trying to run or write anything to the drive anymore? The less you do to the drive the better. You might also consider talking to someone like "Dave Bitcoin" (you can find him easily) who has many years experience helping people recover wallets for a 20% bounty (only on the ones he is successful on). Title: Re: How to recover btc after windows reinstall Post by: papercoins on July 19, 2017, 01:18:28 AM what files are required to recover your BTC? I am having same issue with my bitcoin core and did not back up the private passkey.
Title: Re: How to recover btc after windows reinstall Post by: HCP on July 19, 2017, 01:32:24 AM If you don't know your wallet passphrase, then trying to recover your coins from Bitcoin Core will be quite difficult. There is no way to recover the private keys from an encrypted wallet.dat file without the passphrase.
You'll need your wallet.dat file and to use a script like btcrecover (https://github.com/gurnec/btcrecover) to be able to try and recover the passphrase. Title: Re: How to recover btc after windows reinstall Post by: papercoins on July 19, 2017, 01:50:45 AM is the passphrase the same as the password used to send transfers with? if so I have that. Can I use only the passphrase to recover my coins?
Title: Re: How to recover btc after windows reinstall Post by: HCP on July 19, 2017, 03:13:01 AM ... and did not back up the private passkey. oh... so you mean you didn't backup your private keys? How old was your wallet... was it setup before v0.13? or is it relatively new (ie. was it an HD wallet)?You cannot recover with just the passphrase... you need a copy of your wallet.dat file! Title: Re: How to recover btc after windows reinstall Post by: papercoins on July 19, 2017, 04:54:34 AM iv had the wallet for at least 4 years. I was able to access the files they look to still be intact I found bitcoin-core1 but it was in a .js file and also a .svg file
not sure how to access the wallet.dat file Title: Re: How to recover btc after windows reinstall Post by: HCP on July 19, 2017, 06:36:49 AM Ok, so you mean you deleted/reformatted your drive and you're trying to recover files?
Well, the actual wallet file for Bitcoin Qt/Core is "wallet.dat". If you don't have a wallet.dat file, then your wallet is gone. Unless you can recover the wallet.dat file, there is nothing else for you to do at this point except consider professional recovery services that may be able to run deeper scans on your drive. Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 19, 2017, 06:36:12 PM I'm trying to install pywallet in Windows 10 but can't get any further. I am trying to follow achow101's instructions but where it says shift and right click at the ez setup folder, I don't get an option to open a command window here. Could someone give me some pointers so I can progress further with the install. Thanks.
Title: Re: How to recover btc after windows reinstall Post by: HCP on July 19, 2017, 07:10:02 PM Make sure you haven't highlighted a file when you shift+right click...
highlight the folder and shift+right click and you should get either "open a command window here" or possibly "open Powershell window here" (as I think one of the recent Windows 10 updates tried to make Powershell the default instead of command)... If you really need a command prompt... Press "start"... type cmd and press enter... it will open a command prompt... but probably not at the correct location... you'll need to figure out the path to this "ez setup" folder... and use the "cd" command (http://www.digitalcitizen.life/command-prompt-how-use-basic-commands) Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 19, 2017, 07:33:19 PM It opens a command shell window, do I type ez_setup.py in there? do I leave any spaces and do I press enter?. thanks.
Title: Re: How to recover btc after windows reinstall Post by: TheReamer on July 19, 2017, 08:29:18 PM Maybe try recuva
Title: Re: How to recover btc after windows reinstall Post by: HCP on July 20, 2017, 11:33:33 AM It opens a command shell window, do I type ez_setup.py in there? do I leave any spaces and do I press enter?. thanks. I have no idea what instructions you're following... or what exactly you're doing... so once you have the command prompt (or powershell) opened where you need it, I guess you should just continue following the instructionsTitle: Re: How to recover btc after windows reinstall Post by: neuralnet on July 20, 2017, 03:15:25 PM :-\ thanks for any info in here.
Title: Re: How to recover btc after windows reinstall Post by: papercoins on July 25, 2017, 10:29:24 PM I am paying a professional company to do a raw recovery on my hard drive. Question what exactly is needed to recover my bitcoins from bitcoin core? wallet.dat file only?
Title: Re: How to recover btc after windows reinstall Post by: HCP on July 26, 2017, 03:12:33 AM I am paying a professional company to do a raw recovery on my hard drive. Question what exactly is needed to recover my bitcoins from bitcoin core? wallet.dat file only? Yes, from Bitcoin Core, the wallet.dat file is everything... If you have that, it is generally a simple matter of reinstalling Bitcoin Core, running it once so that it sets up a wallet.dat... shutting it down and replacing the new wallet.dat with your recovered wallet.dat. Start Core up and all your addresses should be available. NOTE: unless the new instance of Bitcoin Core is sync'd, you may not see the transaction history or correct balance (but you can still access private keys/addresses etc).Obviously, you'll also need to know the passphrase (if any) for your recovered wallet.dat file to be able to access the private keys and/or spend coins ;) Title: Re: How to recover btc after windows reinstall Post by: morbius55 on July 26, 2017, 06:33:09 AM I am paying a professional company to do a raw recovery on my hard drive. Question what exactly is needed to recover my bitcoins from bitcoin core? wallet.dat file only? Make sure you trust them 100%, you would never know if they had or hadn't recovered it. I presume it is a fair value of BTC that you are trying to recover. is the company experienced in Bitcoin recovery particularly?. Good luck.Title: Re: How to recover btc after windows reinstall Post by: morbius55 on August 26, 2017, 09:42:21 AM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. So I have been trying this method by searching through the corrupt wallet.dat after moving it onto a usb stick. I have searched for the 0420 pattern and it has returned 400 odd results, but I don't know if these results will be possible private keys. I followed the advice of it possibly being the 32 bytes following the sequence and have run the first two through bitaddress which gave me a private key in WIF. I then imported them into my Electrum wallet and unsurprisingly the balance is zero. So I have some questions and would be grateful for any answers. 1. Will any 64 hex character number that is run through bitaddress produce a private key, real or not. 2. Is the fact that I can search this wallet.dat with a hex editor mean it is unencrypted?. 3. How accurate is the 0420 sequence in finding private keys and is over 400 of these in a wallet.dat a usual amount. Thanks again for any info.There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https://sourceforge.net/projects/wxhexeditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://s18.postimg.org/bgx26fz89/unconfirmed.png Click "edit", then "find". https://s17.postimg.org/ex1mslabz/unconfirmed.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://s1.postimg.org/kljg03w6n/unconfirmed.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Title: Re: How to recover btc after windows reinstall Post by: KG17 on February 06, 2023, 10:22:29 PM Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/ This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772 This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. https://i.imgur.com/p77Eyja.png Click "edit", then "find". https://i.imgur.com/IkAmEMY.png This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. https://i.imgur.com/Yufvs5K.png If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients Electrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Hello I recently find back an old hdd which was having my wallet.dat with a few bitcoin in it unfortunately it was partially rewritten with new data... but i still want to be sure the private key is not there anymore. So before doing it on my disk image i decided to test it on a simple wallet that i created my self using bitcoin core "recent version" and it don't find the "0201010420" when I open it using Hex editor. So I have a few questions ... 1) Does the byte before the private key have changes with the version of bitcoin core that was use to create the wallet.dat ? 2) When you mean encrypted wallet you mean the wallet as a whole or just the private key ? Have a nice day :) Title: Re: How to recover btc after windows reinstall Post by: nc50lc on February 07, 2023, 04:34:36 AM -snip- -snip- i decided to test it on a simple wallet that i created my self using bitcoin core "recent version" and it don't find the "0201010420" when I open it using Hex editor. So I have a few questions ...1) Does the byte before the private key have changes with the version of bitcoin core that was use to create the wallet.dat ? 2) When you mean encrypted wallet you mean the wallet as a whole or just the private key ? For testing older wallets, create a new wallet but untick "Descriptor Wallet" during wallet creation; In bitcoin-cli, it's the sixth argument of createwallet command which should be set to false: e.g.: bitcoin-cli createwallet "testwalletname" false false "" false false - Bitcoin Core doesn't encrypt the whole wallet. Otherwise, the user will have to provide the passphrase every time he needs to open/load an encrypted wallet. Title: Re: How to recover btc after windows reinstall Post by: KG17 on February 07, 2023, 08:07:37 AM -snip- -snip- i decided to test it on a simple wallet that i created my self using bitcoin core "recent version" and it don't find the "0201010420" when I open it using Hex editor. So I have a few questions ...1) Does the byte before the private key have changes with the version of bitcoin core that was use to create the wallet.dat ? 2) When you mean encrypted wallet you mean the wallet as a whole or just the private key ? For testing older wallets, create a new wallet but untick "Descriptor Wallet" during wallet creation; In bitcoin-cli, it's the sixth argument of createwallet command which should be set to false: e.g.: bitcoin-cli createwallet "testwalletname" false false "" false false - Bitcoin Core doesn't encrypt the whole wallet. Otherwise, the user will have to provide the passphrase every time he needs to open/load an encrypted wallet. Thank you for you quick response. Also my hdd disk image is around 300 Go and when i launch a search using whexeditor it crashes after a few hours do you have any better software or other way to do this job ? Title: Re: How to recover btc after windows reinstall Post by: NotATether on February 07, 2023, 11:20:01 AM It's Windows so your bitcoin wallet should be in the AppData/Roaming/Bitcoin/wallets folder.
When I reinstalled Windows (8.1) one time, it saved my home folder along with the rest of the old Windows system inside the C:/Windows.old.<number> folder, but it deleted that folder after about 30 days. I don't think every reinstall will do this, so if you have that folder on your system, check there first (and make sure "Hidden Files and Folders" setting is on in File Explorer so that you don't miss it). Title: Re: How to recover btc after windows reinstall Post by: nc50lc on February 07, 2023, 12:06:59 PM -snip- Thank you for you quick response. Also my hdd disk image is around 300 Go and when i launch a search using whexeditor it crashes after a few hours do you have any better software or other way to do this job ? Follow the steps in this post: http://bitcointalk.org/index.php?topic=5408068.msg60653031#msg60653031 And read the warnings in the next few replies. For follow-ups, you can start your own topic and provide more info about your situation for better support. (recommended) Title: Re: How to recover btc after windows reinstall Post by: KG17 on February 08, 2023, 10:41:06 AM -snip- Thank you for you quick response. Also my hdd disk image is around 300 Go and when i launch a search using whexeditor it crashes after a few hours do you have any better software or other way to do this job ? Follow the steps in this post: http://bitcointalk.org/index.php?topic=5408068.msg60653031#msg60653031 And read the warnings in the next few replies. For follow-ups, you can start your own topic and provide more info about your situation for better support. (recommended) I made a my own topic here it is https://bitcointalk.org/index.php?topic=5438742.new#new |
