Yeah that was my thinking, I'm continuing to try a couple of python scripts, I'll report back on my findings but i'm almost certain its long gone.

Recuva can restore data but sometimes merges files if the headers are messed up, so you end up with massive files containing mishmash of data.

I was curious about why pywallet didn't see the actual proper copy of a wallet.dat on a fresh harddisk

Thank you for the replies so far!

I will try putting the keys into something like electrum directly. The reason i doubted they were keys is that they all follow the same pattern at the start and end of the 32byte string, whereas other example i've seen they are very much random, more like the strings which were found at the end of the search.

I've put the hex scan on again and I'll let it run fully this time before i check the results, it's been on over 24hours so far!

the only software which comes up with anything is Recuva, but it recovers .dat files which are 32gigs! maybe i should look closer at them with pywallet perhaps

The other thing about the 0201010420, it only shows up on the computer that had bitcoin on it, so that's a positive

Hello, like many recently, I've been furloughed so I'm using this time to revisit my old hard disks which contained bitcoin core wallet.dat and possible litecoin wallet as well, from 2014/2015. (quickformatted in error )

I've been using the great information in the forum. i've ran the pywallet from here: github.com/jackjack-jj/pywallet on a unbuntu usb drive to scan the old laptop and it comes up with 0 errors and 0 wallets found.

If i connect the disks to my new laptop and run hexeditor search for the string "0201010420" i get just over 70 results on the same disks (i stopped the search half way because it was taking so long). I've copied the the 32bytes after that which might be my private key, however i'm now doubting that they are.

Is it possible the string "0201010420" relates to something else? the 32bytes which follow mostly all have a similar pattern "D0305D........47" are then followed by "00 00"

 at the end of the search there are 3 other 32byte strings which look more varied such as "09744B......A3"

Using bitaddress.org offline i converted them to btc addresses and checked both the uncompressed and compressed address for transactions, all zero.

It occurs to me that the wallet would be encrypted, I still have the paper where i wrote the password down. Is it possible I need to decrypt these 32byte strings and then check? Or does it not work like that.

I might try run the hexeditor to completion (would take a day or two i think!) and see if there are more results that way.

Should I use a more recent version of pywallet?

I don't think I had much in it. but anything would help right now.

(update i just ran a test of pywallet on another disk where i put a fresh wallet.dat, then deleted it, i ran the test again and it said 0 results, so now i'm wondering if its actually working?!)