Bitcoin Forum

I am stupid and forgot about my coins on my computer. i have formatted and now i think my coins are gone? is there any way i can recover my wallet.dat file? if thats the file i am after?

is there any way i can get them back at all? i am using a Mac, with fresh install of osx 10.7

Yes.  TURN THE COMPUTER OFF IMMEDIATELY.  Don't shut it down or anything, just pull the plug.

There is a utility that scan scan the whole hard drive for lost wallets.  I will get you more info in a moment.

Info on recovery utility here:  https://bitcointalk.org/index.php?topic=25091.0

You will need to burn a Linux boot disc using another computer.  SystemRescueCD is a good choice.  Put it in the mac, hold down the C key, power on, then release it when it starts to boot.

The thread has instructions on how to perform the recovery.  If you're not familiar with using Linux (let alone the command line) then you'll probably find it a bit confusing.  We'll help you through it.

I'm sure this will help.

i have the hard drive out of the computer. plugged into a usb adapter and powered on connected to another mac i have..

just reading that thread now cheers.

Goodluck, let me know how it goes.

Still going along with it.... had to use one of my mining rigs, to get it working and in the process now! for about the 3rd time. macbooks dont like to boot from usb with linux no more..

bout 40% the way thru but its still showing no keys found.

the drive was almost at capacity when i formatted it with the bitcoin wallet a new addition (hence why i just forgot about it) all i did was format and install a fresh os on it. so heres hoping that it can be recovered.

i did try a few other disk recovery tools but were all pretty shit.

You could try Parted Magic, a cd/usb based Linux distro designed around drive operations/data recovery etc.

http://partedmagic.com/doku.php

It is free, so it is worth a shot.

There are a few data recovery programs in the distro. In my experience, the best ones are command line based, so be prepared to dive into that dark world  ;)

So i have completed the program linked up above by Revalin but it recovered nothing at all...

am i doomed or what? there is a considerable amount of coins here pretty much all my mining efforts gone..

i do have some of the publc keys i used to transfer the coins to this wallet.

The coins are gone unless you can get the private keys in the wallet. The public keys are only going to let you know how many coins you have.

I have seen in the past some reputable members try to recover coins for members if you shipped them your hard drive. I guess it would be a bit of a pain because its a mac so unless your comfortable taking it apart to get the HDD you would need to ship the entire unit. It sounds as if that computer is for everyday use too so im not sure if you could do without it. It still may be a better option then losing all your coins. I forget who offered the service in the past. :\

Was the wallet encrypted?  There's a note on that thread that the tool doesn't work with encrypted wallets.  If it was using the encrypted format then we may have to modify it a bit.

I got a few computers, the drives is out and connected up to a linux machine which i ran them programs and found nothing. however using hex editor/search i can find instances of 0420 so maybe all isnt lost. casascius is going to work on it next week for me so with a bit of luck there is something still there.

mac windows etc.. its all the same when your looking at it this way..

Also I see v0.3 which supports compressed public keys was just released, so if your scan was done with a version prior to 0.3, it wouldn't have detected anything if you are running Bitcoin v0.6.x, which uses compressed public keys.

The key phrase in the first post is "fresh install", that the OS was reinstalled and used after the formatting too, drastically reducing the chance of recoverable data remaining in unwritten areas.

If you do a quick format, which takes just a few seconds, then the majority of the data areas may still have been intact (until the reinstallation of another OS). If however a full format was done (10 minutes to several hours depending on the drive size and tech), this writes zeroes to all data areas of the hard drive, removing the option of recovery. This depends on how the OSX formatter's (appropriately called "erase disk") security option was set:

http://www.kenstone6.net/fcp_homepage/images_partitioning_tiger/00_partitioning_tiger.jpg

A piece of advice (this won't help now, but it will later):

When you have a wallet, make physical QR codes of the public addresses AND private keys. Match them as well. Multiple copies of the keys in case one is damaged or lost. Then you can scan the code with your webcam (yes, tools exist that do that) and recover them. This has not been tested on encrypted wallets, but probably won't work on them.

to gain a bit more confidence on the restorability of the data you could do a deep scan for each one of the public keys. I appended a  bash script which does that for you. You need to modify the pubkey variable and redirect dd to the correct hard disc. the loop assumes that your hard disc is less than 2TB. Also, make sure you have root access to the drive...

If you find one public key on the disc that might be an indication that the restoration tool has failed you but the data is still there.

I don't know how much you know about data restoration but it may pay off to find someone to do it for you.
All depends on trust level and whether the amount is worth it....

good luck!

script:
===
#!/bin/bash

pubkey=1Nn3GoGpWj3UonxUq4VB432T8fxnBmec2b

for i in {0..2000000}; do
 dd if=/dev/sda2 of=block.dat bs=1M count=2 skip=$i &>/dev/null
 grep $pubkey block.dat &>/dev/null
 if [ $? -eq 0 ] ; then
  echo "public key found, block $i"
  break
 fi
done

Perhaps you can offer some instruction on how to do this for those non-technical people who are using the standard bitcoin client?  It doesn't offer any buttons or menu options to do this, or even to see what your private key is.

Hey guys thanks for the extra help and advice here, i am just running .3 now after being away all weekend.

i know a little about data recovery but have never really dove this far into it before.

i dont think i zero'd out data on the format, just did a quick format.

if this .3 tool fails to recover again i will be talking to cassicaus , and perhaps trying the quick script above.

but in the end if its gone i guess its gone :(

This is still a crucial detail:

Nope i thought i mentioned it wasnt encrypted..

anyway its now done, 110 keys found.. however in ubuntu i am having troubles copying the file that has been made.

it has a lock on it and i cant copy move or anything with this file.

i am using ubuntu desktop off a usb stick so its not installed? i have not created a persistent drive with this install also.. so when i restart the computer i am back to square one..

so i am running this again to get the 110 keys once more and will leave the computer on

can someone help me with this step?? seems to me like file permissions? says its owned by root?

Do you have another USB stick?  If so just put it in and then:

Find the USB stick's name:
ls /media

Copy the recovered wallet there:
cp new_wallet.db /media/usb_stick_name/

permissions denied to open/copy that file still?

sudo cp new_wallet.db /media/usb_stick_name/

beautiful.. thankyou so much..

whats your bitcoin address..

as soon as i can transfer them i will send you some too. along with the creator of that program if he ever sends me his address..

where would the wallet.dat file be located on my linux desktop usb?? is it called wallet.cpp or wallet.h on linux?

Makomk deserves most of the love, but if there's any left over you can send it to 165YUuQUWhBz3d27iXKxRiazQnjEtJNG9g .  :)

.cpp and .h are C source code.  Your wallet should just be called wallet.dat.  It will usually be in /home/<username>/.bitcoin .

Just to add a little detail. If you can't find the .bitcoin directory on your home dir press CTRL+H to unhide it ;)

Good to hear it worked out!  Always glad to help.

Yes, always wipe your hard drives...  AFTER you save your BTC.  :)

haha that was a fat wallet! glad you got your coins back instead of losing them forever the the aether :)

Oh yes, a bit of coin trading, and about two years of mining @ 2gh/s.

i turned all the rigs off now however, electricity was killing me and was pretty much break even.

now i have the coins back i can start trading a little again.. should sell my 5970's and pay the electricity bill too

Yeah, I noticed your payment to me this morning - thanks! Glad to hear that it all worked out in the end and you managed to get your bitcoins back!

A zero fill does not generally remove the option of recovery on spinning disks (if you only zero fill once). I'm not sure about SSDs, but it probably doesn't remove the option on those either.

A zero wipe changes it from "here run this utility" to requiring an electron microscope to maybe POSSIBLY recover something (at modern drive densities it's debatable whether it's possible at all).  That's close enough for most people.