I have tried another recovered wallet.dat file and it hasn't crashed. If there are some coins in it, how long would they take to show up. Thanks.
It could take a long time, you have to wait for core to sync before you can see balances. Check all the addresses that core shows in a block explorer like this one. If an address contains coins the block explorer will immediately tell you. https://blockchain.info/How much hd space does it require to fully sync?. Also does it matter that I renamed folder to wallet.dat2. |
|
|
|
|
I have tried another recovered wallet.dat file and it hasn't crashed. If there are some coins in it, how long would they take to show up. Thanks.
|
|
|
|
Hi, I want to recover my corrupted wallet.dat file with Pywallet, Please describe me that how can i start & what's the methods to do this?
I want to look into Pywallet, attempt to scan a wallet.dat for keys and construct a new one.
Thank You.
I also would like a guide on setting this up, but i'm not holding my breath. |
|
|
|
Doesn't even seem to try to salvage.  |
|
|
|
|
Do I run salvagewallet from the shortcut I created for Bitcoin Qt by opening properties then typing salvagewallet after exe leaving a space first, then hit apply and okay?.
|
|
|
|
Is that log the result of opening the wallet.dat in core, or the result of using the salvagewallet option on it? The "can't rename" error often occurs when using the salvagewallet option. It is from opening in Bitcoin core. |
|
|
|
Does salvage wallet run automatically in latest Bitcoin core?.
It's looking like I need to figure out how to setup and use Pywallet.
I take it that this means that Bitcoin Core was unable to read the recovered wallet.dat file that you attempted to import? Did you get any errors... or did it just come up with a zero balance? If it came up with a zero balance, it is highly likely that this was just an empty wallet that had been generated by an earlier installation of Bitcoin Core but was never used. If you got errors, can you post the debug.log from when you attempted to load the recovered wallet.dat. NOTE: Please use pastebin.com for this and just post the pastebin link!  Hopefully done this right, never used pastebin before. https://pastebin.com/tCbE7E2C |
|
|
|
|
Does salvage wallet run automatically in latest Bitcoin core?.
It's looking like I need to figure out how to setup and use Pywallet.
|
|
|
|
|
I'm getting a similar result when trying my wallet dat, but using the latest Bitcoin core. I get Failed to rename wallet.dat to wallet.1499712863.bak.
|
|
|
|
|
So to summarise, download latest bitcoin core.
delete wallet.dat from it.
Replace with my recovered wallet .dat.
Start bitcoin core.
Cross everything.
Is that correct?. Thanks and sorry for novice questions.
|
|
|
|
|
Which Bitcoin wallet should I download? to give it a try. thanks.
|
|
|
|
I ran a different recovery program and it found wallet.dat folder 96kb, a chainstate folder and a blocks folder. When it had found these folders it classed them as in good condition yet the wallet dat folder is only 96kb? can that be right.
If someone else had accessed this file and removed any keys would that reduce it to 96kb. Thanks.
That sounds exactly right. I tested generating a wallet.dat with a very old version of Bitcoin core and it was 96KB. Make some backups of it then test it to find out if it's not corrupted. Have you tried opening the wallet.dat from inside Bitcoin core yet? You don't need to sync Bitcoin core to find out if the wallet isn't corrupted. I thought that a used wallet dat file would be larger than 96kb ie one with transactions. Thanks again for your reply. |
|
|
|
|
I ran a different recovery program and it found wallet.dat folder 96kb, a chainstate folder and a blocks folder. When it had found these folders it classed them as in good condition yet the wallet dat folder is only 96kb? can that be right.
If someone else had accessed this file and removed any keys would that reduce it to 96kb. Thanks.
|
|
|
|
Sorry to bug you again but when i start hex editor, the drive letter doesn't appear, only drive D. Thanks.
Are you trying to scan an external drive or your internal one with your operating system running on it? It should already be able to see all your external hard drives. By default it only scans external drives like the type you plug into a USB port. I only recommend running it inside a vmware or virtual box virtual machine in case there is anything malicious hidden in it. I wouldn't ever risk searching for private keys in plain text while running it on my internet connected operating system. If you can't see a particular external hard drive with it then you could try running it with administrative privileges in windows, or as root in linux. However if you risk doing that you must definitely run the hex editor inside a virtual machine for safety. If you give it administrative privileges or make it root then you are giving it control of your operating system, and that's a big security risk. Also, it will be able to open your drive running your operating system which will probably show as physicaldrive0. If you edit the hex on that drive you could crash your operating system. Sussed it thanks, Administrator privileges required when running program. Listed as drive 1 and indicating around 9 hrs per search. Cheers. |
|
|
|
Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search.  Click "edit", then "find".  This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive.  If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clientshttp://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clientsElectrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Does that sequence always occur before every private key in your experience?. Thanks again. Someone else did some testing and found that sequence before every key he tested. I also tested it and came to the same conclusion. However it might not always work. Another sequence you can try searching for is 01036B65794104. If you find it and also find the sequence 0420 about 180 bytes later, then the next thirty-two bytes are probably a private key. This quote explains it in more detail. If you know how to use a hex editor you could try scanning your drive for this sequence of bytes: 01 03 6B 65 79 41 04. That sequence often occurs in a wallet.dat file about 180 bytes before a private key. If you look forward 180 bytes and can find the byte sequence 04 20 then it's likely a private key is the next the thirty-two bytes. If you find a private key you can change it to a common format by pasting the thirty-two bytes into an offline copy of this webpage. https://www.bitaddress.org/This is an example of the 32 bytes of a private key in botepad.  This is the private key copied from notepad and pasted into an offline copy of the bitaddress website. Click the view details button to get the private key converted to normal formats.  There's a more detailed explanation of the byte sequences to search for in this quote. I have been doing some tinkering around, thinking about other people's wallet disasters, and believe I have come to the following conclusion...
If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer. If so, recovery is no longer purely theoretical. With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable.
So here goes...
If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence:
01 03 6B 65 79 41 04...........
the middle four of these bytes represent the string "keyA" in ASCII.
Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later. The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s).
Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex). These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes). If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins! Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find. Carefully search the sectors adjacent to any sector containing the "keyA" sequence above. Then yell for help! (But don't share the private keys in public, unless you want to give away your wallet.)
An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex. In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan. Scanning a full disk can take hours. WinHex must "run as administrator" to be able to scan a physical disk. Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible. Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary.
Sorry to bug you again but when i start hex editor, the drive letter doesn't appear, only drive D. Thanks. |
|
|
|
Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. Click "edit", then "find". This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clientshttp://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clientsElectrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Does that sequence always occur before every private key in your experience?. Thanks again. [/quote] |
|
|
|
Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was. There is an alternative to using pywallet, but it requires more time and effort. If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key. If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address. https://www.bitaddress.org/This post explains how to use the webpage. https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772This hex editor is capable of searching a whole hard drive. https[Suspicious link removed]ditor/ These screenshots explain how to open a disk, then search it for the hex string. Click "devices", then "open disk device", then select the disk letter you want to search. Click "edit", then "find". This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive. If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet. If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions. http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clientshttp://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clientsElectrum should sync almost immediately and give you fast access to your coins. Don't ever boot from that hard drive again because doing so could wipe all traces of your coins. Thanks, really appreciate this. Probably last chance saloon if my attempt with Recuva is anything to go by. I do have the password, but don't know whether the wallet was locked the last time it was used. If this doesn't find anything then would pywallet be able to scan the whole drive?. Thanks again, and to anyone else that has given helpful comments.  |
|
|
|
|
Show Posts
