Bitcoin Forum

is this possible after exporting from Bitcoin-qt?

what do you mean exactly?
dumpprivkey only tells you the private key, doesn't delete it from your wallet, AFAIK.

well over a year ago, i used Armory to move my signature privkey from Qt into Armory.  i don't remember the exact sequence of commands i used to accomplish this but nonetheless i find only my pubkey remaining in Qt.

are there any remnants of the privkey in Qt or am i stuck?

Everything should be there.

To export a private key from your Satoshi bitcoin-qt client:

    1- launch your bitcoin client as usual and wait for it to load the blockchain and start up
    2- click on 'help' in the menu bar (top right)
    3- click on 'debug window'
    4- select the 'console' tab
    5- type: walletpassphrase "your walletpassphrase here" 600
    6- type: dumpprivkey [your public key here]
    7- this will return the private key, you can copy it now; ensure you clear your clipboard/history afterwards
    8- type: walletlock

Skip steps 5 and 8 in case your wallet is not encrypted.

sorry, already tried that:  Private key for address * not known (code -4)

can you be a little more specific about the command lines involved and from what folder?

Are you sure you're trying the correct pubkey? Is the address you're trying to get the privkey from really yours? Didn't you grab it from the Address Book instead of from the Receive tab or something?

wait, in that series of instructions, was i supposed to insert the pubkey or the address?  if it is the latter, that is what i did.

and yes, this was my vanitygen address that i originally imported into this wallet but then subsequently exported to Armory.

If this definitely doesn't work you could try pywallet

and on a mac and from which directory?

how would i do that?  never used it before.

On Linux it's really easy, it's a bit more complicated on Windows but still fairly simple.
Take a look at pywallet.tk and tell me if something seems strange/difficult.

can you point me to a link for a mac?

As it's written in the link I just gave you (;)), the instructions for Mac is in the README (https://github.com/jackjack-jj/pywallet/blob/master/README).
I never checked myself as I don't have a Mac, they come from an user.

can i simply move a copy of the wallet.dat over to a linux computer and then use pywallet to extract private keys?

Yes.

is this download link working?  https://github.com/jackjack-jj/pywallet

Yes

ok, i'm lost, how do i install it?   i'm now in linux and i've installed python, twisted, and bsddb.

should work and print help.

Then
to dump /home/jj/walletzz.dat

sorry.  how do i actually install pywallet?  not used to navigating github.

Oh yeah sorry
in the directory you want to put pywallet in

In Github you can retrieve the raw file by clicking the 'Raw' button, top left of screen when you click on the file.

getting this:


problem is i did do a bitcoind stop command.

Are you sure the directory and filename are correct?
Do you have the correct permissions? (maybe try sudo?)
Are you sure all the bitcoind/bitcoin-qt are closed? (run fuser on it)

i need to clarify something before going forward. 

i moved a copy of the wallet.dat in question to the desktop of this pc which is the wallet that i hope to dump the keys from.  will running pywallet effect any other wallet.dat on this computer?

Nope, pywallet will only deal with files you provide to it
Also, dumping won't modify them

ok, i think i got it.

how do i identify the privkey?

The private key is the "hexsec" entry
If the wallet is encrypted you need to put the passphrase by adding ' --passphrase=PASSPHRASE' in the command line

you mean like?:

Absolutely

how would i integrate a |less command?

unfortunately doesn't seem to have worked.

i got a huge dump and i see the address in the "names" list but not anywhere else with a hexsec  :(

You see it in the "name" list but not in the "key" list??
I don't even know how that can happen. Except using the pywallet feature but you don't seem to used it.

i ran pywallet just like you said in linux on the wallet in question and it only produced my vanitygen address in the "name" list w/o a hexsec but nowhere else in the key list above it.

Do other addresses have hexsecs? Do you see this address in the first list (even without hexsec)?

yes, all the other addresses have hexsecs and no the vanitygen address is not listed there.  only in the "names" list.

didn't work.

on a mac, it's not a *.exe, it's an *.app file.  and the term is alias, not shortcut.

Then I'm sorry, I can't help you
AFAIK pywallet is the only tool that allows you to delete an address but it would have deleted the entry in "names" too anyway
I really don't see what happened here

If you definitely can't find it again, you should consider using pywallet's recovery feature

this is what i keep getting using -salvagewallet and -rescan on Mac itself:

remember that i used Armory's import key function which extracts the key out of Qt.  it appears that it does what it says it does and this is irreversible.

i don't see a command for that.

So, can't you get it out of the Armory wallet it was imported to?

no, b/c it got deleted.   ;D

I'm afraid to ask about backups now ::)

believe it or not i lost 3 USB keys in the last 2 months with backups to this key on them.  ;D

https://bitcointalk.org/index.php?topic=34028.msg2763547#msg2763547

does this look right before i run it?:


edit:  do i need the passphrase?

Err, no, wallet.dat is not an "outputdir"... You need an empty folder where, I guess, all the found wallet ghosts will be written.

You need to change:
 - 500Go to the approximate size of your partition (better higher than lower)
 - /dev/sdax to the partition you want to look into (sudo fdisk -l might help)
 - As Kouye said recov_outputdir must be a directory, empty or not

Pywallet will ask for the passphrases

The recovered file will be named "recovered_wallet_{timestamp}.dat"

so this where "output" is a new empty folder?

If your partition is like 300->500Go large, and if you never stored a wallet outside of /dev/sdax, then I guess it's ok.
If you think you might have stored/copied your wallet elsewhere, you'll need to retry with [elsewhere] instead of /dev/sdax, once this fails.

this is what i have:

i have to be careful b/c i'm doing this on my linux mining server which has it's own wallet.dat and was not the originating computer.

i've copied the wallet.dat in question to the Desktop and need to confine any operations to it.

Ok maybe I was not clear enough

This feature will read all the bytes on the partition you provide (/dev/sdax) and then gather everything that looks like a key
It does not read your wallet to try to repair it

That's why you need to put the partition where your wallet was/is

well then i'm going to have to move it back to the Windows system where it originated.

Also, you need to replace the 'x' in "/dev/sdax" by 2 or 5, depending on which partition your wallet was stored/copied on. If not sure, try both.
Sorry JackJack, this was begining to look like a mandatory hint.

i've got this feeling the recovery feature is not going to work unless those key remnants in a dev/sda get stored in a VM, which i doubt.

the macbook on which that VM and Windows resides had to be reformatted and a new mac OS had to be installed for other reasons.  the VM/Windows image was then restored that had originally generated the wallet.

i could be wrong.

If your wallet was stored on a vhd or equivalent virtual hard drive file, then you probably need to run the pywallet command on a VM with this vhd mounted, yes.
I doubt it would be able to parse private keys from a virtual hard drive file - but I might be wrong.

So restore the vhd, run a vm with this vhd mounted, install pywallet, and try the command line, targeting the vhd partition.

is there such a thing as mounting a hard drive in Windows?

Yes, but if it's a virtual hard drive, you need a compatible VM. What soft were you hosting the VM with (vmware, hyper-v, virtual server, etc.) ?

vmware fusion

Cool, I never used it, but it should be easy enough, using google, to make a new vm and mount your old hard-drive image in this new VM.
Then run pywallet from this newly created vm, pointing to the partition of this old-restored-mounted-drive you think your wallet has ever been stored or copied to.

ok, installed python 2.7, twisted, and zope-interface.

how do i install pywallet, then run it on the C:drive?

download pywallet.py from github and run it from the windows command line.

Yup

The code was bugged for linux/mac, the last version is working: http://pastebin.com/raw.php?i=wmXTdQrf

i should be able to get this to work.  i've installed all the tools for pywallet onto the exact windows computer that vanitygen'd "1cypher".  i dumped the current wallet using 8989 but this isn't a wallet that ever had "1cypher".  but the remnants must be somewhere in this OS if you're correct about how vanitygen leaving traces of the address that can be recovered. 

for the life of me though, i can't get the right combination of commands to "recover" the privkey from this.  not a frequent command line user:


any further suggestions?

"pywallet.py --web" and then navigate to http://localhost:8989/, work with the entire pub key to find it "1cypherEucdwyZ8Xn84M8qUscjBXnWGZA"

This tool never failed me once and I thank jackjack for making it.

it doesn't appear that the web gui can recover a lone privkey if it's not in a wallet.  ie, it doesn't have the recovery feature.

i'm hoping the privkey is somewhere on this C: drive since it was generated on this machine.

1- Download pywallet_2.1.0b4.py to C:\   ^*
2- Create a dir named "recovered" on C:\  ^*
* It's a terrible idea to write files to the disk from where you want to recover lost wallets/private keys, but being it a VM I don't see any other way.

i remembered incorrectly.  it was not generated on a vm.  

i am now on the exact Windows machine i generated "1cypher" on last year so if a privkey remnant is stored somewhere in the hard drive as jackjack suggests, then it should be here.

having said that, here is what i get when i execute your command:


edit:  i originally installed pywallet to the Downloads folder but dragged it over to C: just b/c it didn't run when i initially directed it at Downloads.

Your best bet is to work with the "wallet.dat" that once contained the priv key. Like psy previously said the C: drive was probably rewritten so you wouldn't have a chance of getting anything.

How about the Armory wallet? You imported the priv key with it?

actually i think the opposite.

i already dumped the keys twice, once using linux and once using 8989 in Windows, from this wallet.dat using jackjack's tool but it's not in there despite "1cypher..." being in there.  i think Armory extracts the privkey permanently.

seems my only chance is to recover it from somewhere on the hard drive.  remember, this hard drive has NOT been overwritten since the privkey was generated.  it is a Windows system on a Mac booted thru BootCamp.

jackjack's 8989 tool doesn't have a disk recovery mode.  and i can't seem to get the command line argument to work right despite installing python, twisted, zope-interface, pywallet, etc and using psy's/jackjacks commands.  it's probably some simple command line error i'm making.  i'm making sure all those tools are in the same folder along with a new directory called "recovery" when i run the command but nothing happens.  it just flips me back to the same command prompt.

edit:  just got this response from etotheipi:

" Nothing is stopping you from doing that.  The key data doesn't actually leave the original wallet.  It's just copied."

 ???

What is the output of the following?

python pywallet_2.1.0b4.py --recover --recov_device "C:" --recov_size 1000Go --recov_outputdir "C:\recovered"

C:\>python pywallet_2.1.0b4.py --recover --recov_device "C:" --recov_size 1000Go
 --recov_outputdir "C:\recovered"
'python' is not recognized as an internal or external command,
operable program or batch file.

C:\>

Thanks, I can't even read...

Try this then


Yeah pretty much what I thought.

where do i find pycrypto and libssl?

I think you can google them to find them but the problem here is not pycrypto or libssl

What you need to do is running the console as an administrator
Do this:
http://www.howtogeek.com/geekers/up/sshot4e9bf25373f10.jpg
Then right click on cmd, Run as administrator

still no go.

The hard drive data might be irrecoverable, but perhaps the thumb driives aren't? Maybe more efforts need to be centered in searching for the missing drives at this point.

We need info to help you...
What does no go means? What do you see? Error messages?

no go means didn't work.  ran this from the administrator command line like you recommended:


both python and pywallet are in the Python27 folder

https://i.imgur.com/5s1weO2.png

Ok, change the command to this:

Report the error if it goes bad again

C:\Python27>python.exe pywallet_2.1.0b4.py --recover --recov_device "C:" --recov
_size 1000Go --recov_outputdir "C:\recovered"
python.exe: can't open file 'pywallet_2.1.0b4.py': [Errno 2] No such file or dir
ectory

C:\Python27>

First put the content of this (https://raw.github.com/jackjack-jj/pywallet/master/pywallet.py) in pywallet.py in c:\python27
Then replace pywallet_2.1.0b4.py by pywallet.py in the command

working...

now what?  was hoping it'd spit out the unencrypted keys?  ;D

here's what inside "recovered":

{'\x00\x01\x03key': [130331297, 130331761, 130332225, 130332689, 130333153, 130333617, 130334081, 130334545, 130335009, 130335473, 130335937, 130336401, 130336865, 130337329, 130337793, 130338257, 130339289, 130339653, 130340017, 130343861, 130344225, 130344589, 130344953, 130344953, 130345317, 130345681, 130347481, 130347845, 130348209, 130348573, 130348937, 130349301, 130349665, 130350029, 130350393, 130350757, 130351121, 130351485, 130351849, 130352213, 130352577, 130352941, 130353305, 130353669, 130354033, 130354397, 130354761, 130355125, 130355673, 130356037, 130356401, 130356765, 130357129, 130357493, 130357857, 130358221, 130358585, 130358949, 130359313, 130359677, 130360041, 130360405, 130360769, 130361133, 130361497, 130361861, 130362225, 130362589, 130362953, 130363317, 130372473, 130375545, 130375909, 130378973, 130379337, 130379701, 130381341, 130381705, 130382069, 130382433, 130382797, 130383161, 130383525, 130383889, 130384253, 130384617, 130384981, 130385345, 130385709, 130386073, 130386437, 130386801, 130387165, 130387529, 130387893, 130397725, 130398089, 130398453, 130398817, 130399181, 130399545, 130399909, 130400273, 130400637, 130401001, 130401365, 130401729, 130402093, 130402457, 130402821, 130403185, 130403549, 130403913, 130404277, 130408101, 130408465, 130408829, 130409193, 130409557, 130409921, 130410285, 130410649, 130411013, 130411377, 130411741, 130412105, 130412469, 130417749, 130418113, 130418477, 130418841, 130419205, 130419569, 130419933, 130420297, 130420661, 2877809405L, 2878035952L, 5839039626L, 5879747771L, 5911816308L, 6071820192L, 21208879577L, 21218767737L, 21218898393L, 21219103609L, 21219455449L, 21219742169L, 21220061657L, 21220921817L, 21220938201L, 21220938565L, 21220938929L, 21220939293L, 21220939657L, 21220940021L, 21220940385L, 21220940749L, 21220941113L, 21222019545L, 21222306265L, 21223133657L, 21223134021L, 21223134385L, 21223469529L, 21224960473L, 21225689977L, 21226492377L, 23191145553L, 23191145917L, 23191146281L, 23191146645L, 23191147009L, 23191147373L, 23191147737L, 23191148101L, 23191148465L, 29655516245L, 29655516609L, 29655516973L, 29655517337L, 29655517701L, 29655518065L, 29655518429L, 29655518793L, 29655519157L, 39220714757L, 39220715221L, 39220715685L, 39220716149L, 39220716613L, 39220717077L, 39220717541L, 39220718005L, 39220718469L, 39220718933L, 39220719397L, 39220719861L, 39220720325L, 39220720789L, 39220721253L, 39220721717L, 39940293717L, 39940294081L, 39940294445L, 39940294809L, 39940295173L, 39940295537L, 39940295901L, 39940296265L, 39940296629L, 40233877521L, 40233877885L, 40233878249L, 40233878613L, 40233878977L, 40233879341L, 40233879705L, 40233880069L, 40233880433L, 40233880797L, 40233881161L, 40233881525L, 40233882073L, 40233882437L, 40233882801L, 40233883165L, 40233883529L, 40233883893L, 40233884257L, 40233884621L, 40233884985L, 40233885349L, 40233885713L, 40233886077L, 40233886441L, 40233886805L, 40233887169L, 40233887533L, 40233887897L, 40233888261L, 40233888625L, 40233888989L, 40233889353L, 40233889717L, 40233898873L, 40233901945L, 40233902309L, 40233905373L, 40233905737L, 40233906101L, 40233907741L, 40233908105L, 40233908469L, 40233908833L, 40233909197L, 40233909561L, 40233909925L, 42129367805L, 42520978469L, 42520978833L, 42520979197L, 42520979561L, 42520979925L, 42520980289L, 42520980653L, 42520981017L, 42520981381L, 42520981745L, 42520982109L, 42520982473L, 42520982837L, 42520983201L, 42520983565L, 42520983929L, 42520984293L, 42520984657L, 42520985021L, 42520985385L, 42533618681L, 42533619045L, 42533619409L, 42533619773L, 42533620137L, 42533620501L, 42533620865L, 42533621229L, 42533621593L, 42533621957L, 42533622321L, 42533622685L, 42533623049L, 42679887757L, 42679888121L, 42679888485L, 42679892329L, 42679892693L, 42679893057L, 42679893421L, 42679893785L, 42679894149L, 43341759573L, 43341759937L, 43341760301L, 43341760665L, 43341761029L, 43341761393L, 43341761757L, 43341762121L, 43341762485L, 50091500285L, 50695996501L, 50695996865L, 50695997229L, 50695997593L, 50695997957L, 50695998321L, 50695998685L, 50695999049L, 50695999413L, 52002136537L, 52137503329L, 52137503693L, 52137504057L, 52137504421L, 52137504785L, 52137505149L, 52137505513L, 52137505877L, 52137506241L, 52137506605L, 52137506969L, 52137507333L, 52137507697L, 52137508061L, 52137508425L, 52137508789L, 52140810713L, 52140811077L, 52140811441L, 52145116245L, 52145116609L, 52145116973L, 52145117337L, 52145117701L, 52145118065L, 52145118429L, 52145118793L, 52145119157L, 52149420505L, 52149420869L, 52149421233L, 52183196321L, 52183196785L, 52183197249L, 52183197713L, 52183198177L, 52183198641L, 52184130009L, 52194738649L, 52194739013L, 52194739377L, 52197934985L, 52197935349L, 52200424097L, 52223394265L, 52223394629L, 52226851289L, 52226851653L, 52226852017L, 52226852381L, 52226852745L, 52226853109L, 52226853473L, 52248969689L, 52248970053L, 52248970417L, 52248970781L, 52248971145L, 52250657241L, 52250657605L, 52250657969L, 52254581209L, 52254581573L, 52254581937L, 52254582301L, 52262666713L, 52262667077L, 52262667441L, 52269113817L, 52269114181L, 52269114545L, 52269114909L, 52269115273L, 52269115637L, 52269116001L, 52274759561L, 52274759925L, 52276200097L, 52276200561L, 52276201025L, 52276201489L, 52285727193L, 52323017177L, 52323862409L, 52324689801L, 52324690165L, 52369973721L, 52369974085L, 52369974449L, 52369974813L, 52369975177L, 52369975541L, 52369975905L, 52369976269L, 52384067237L, 52384760281L, 52384760645L, 52384761009L, 52384761373L, 52384761737L, 52384762101L, 52384762465L, 52384762829L, 52384763193L, 52384763557L, 52390201225L, 52390201589L, 52390201953L, 52390202317L, 52398506457L, 52398506821L, 52398507185L, 52398507549L, 52404193525L, 52404193889L, 52404194253L, 52404194617L, 52404194981L, 52404195345L, 52404195709L, 52404196073L, 52404196437L, 52404196801L, 52404197165L, 52404197529L, 52404197893L, 52404198257L, 52404198621L, 52404198985L, 52404199349L, 52440477349L, 52446159321L, 52459029153L, 52459029617L, 52474241913L, 52482900441L, 52482900805L, 52482901169L, 52483211737L, 52483212101L, 52483212465L, 52489470425L, 52489470789L, 52489471153L, 52489471517L, 52496024025L, 52496024389L, 52496024753L, 52496025117L, 52496025481L, 52496025845L, 52496026209L, 52496026573L, 52496026937L, 52496027301L, 52496027665L, 52514013657L, 52514014021L, 52514014385L, 52514014749L, 52514015113L, 52514015477L, 52514015841L, 52514016205L, 52514016569L, 52514016933L, 52514017297L, 52515259041L, 52515259505L, 52515259969L, 52515260433L, 52515260897L, 52515261361L, 52515261825L, 52515262289L, 54565808112L, 54568657661L, 61359359061L, 61359359425L, 61359359789L, 61359360153L, 61359360517L, 61359360881L, 61359361245L, 61359361609L, 61359361973L, 65311785885L, 65677464477L, 65937163165L, 66108858561L, 66108858925L, 66108859289L, 66108859653L, 66108860017L, 66108860381L, 66108860745L, 66108861109L, 66108861473L, 66108861837L, 66108862201L, 66108862565L, 66108862929L, 66108863293L, 66108863657L, 66108864021L, 66108864385L, 66108864749L, 66108865113L, 66108866597L, 66108869669L, 66108870033L, 66108873097L, 66108873461L, 66108873825L, 66178680105L, 66231538589L, 66316407709L, 66443335708L, 66456499101L, 66543552193L, 66543552557L, 66543552921L, 66543553285L, 66543553649L, 66543554013L, 66543554377L, 66543554741L, 66543555105L, 66543555469L, 66543555833L, 66543556197L, 66543556561L, 66543556925L, 66543557289L, 66543557653L, 66543558017L, 66543558381L, 66543558745L, 66732162395L, 66733988593L, 66801312669L, 66896557353L, 66955179305L, 75733314525L, 75733314889L, 75733315253L, 75733315617L, 75733315981L, 75733316345L, 75733316709L, 75733317073L, 75733317437L, 75733317801L, 75733318165L, 75733318529L, 75733318893L, 75733319257L, 75733319621L, 75733319985L, 75733320349L, 75733320713L, 75733321077L, 75733321441L, 75733321805L, 75733322169L], '\t\x00\x01\x04mkey': [], 'PRFdevice': '\\\\.\\C:', 'PRFsize': 75902218240L, 'PRFdt': 1653.0170001983643, "'\x00\x01\x04ckey": []}

Put the last code from https://raw.github.com/jackjack-jj/pywallet/master/pywallet.py in pywallet.py
Then
Or if you don't want to lose time change the recov_device parameter to this:
where you change the value with the correct path to the file

nothing recognizable within these recovered files:

https://i.imgur.com/JdW5JQT.png

You renamed the wallet to wallet.dat and ran Bitcoin with 'bitcoin-qt -rescan' ?