Bitcoin Forum
June 23, 2024, 11:27:23 PM *
News: Voting for pizza day contest
 
  Home Help Search Login Register More  
  Show Posts
Pages: [1]
1  Bitcoin / Bitcoin Technical Support / Re: How to recover btc after windows reinstall on: February 08, 2023, 10:41:06 AM
-snip-
Thank you for you quick response. Also my hdd disk image is around 300 Go and when i launch a search using whexeditor it crashes after a few hours do you have any  better software or other way to do this job ?
I don't use whexeditor so I can't suggest a possible solution but pywallet's --recov tool may work.
Follow the steps in this post: http://bitcointalk.org/index.php?topic=5408068.msg60653031#msg60653031
And read the warnings in the next few replies.

For follow-ups, you can start your own topic and provide more info about your situation for better support. (recommended)

I made a my own topic here it is https://bitcointalk.org/index.php?topic=5438742.new#new
2  Bitcoin / Bitcoin Technical Support / Recovery of bitcoin wallet after having re-written on the disk on: February 08, 2023, 10:34:52 AM
Hello everyone I recently came across an old hdd that was having a few bitcoin in it from 2011. The issue is that the hard drive have been partially re-written with a new windows and other datas. I already carefully make a copy of the hard drive to .img file. I already tried the "classical" way of recover the file (recuva, R-studio) ... and they didn't find the wallet.dat (they find other .dat but some from windows).
Even if i know that the chances are low that my wallet or at least the private key is still on this hdd i would like to be 100% there is nothing left. After having search i have seen that we can use pywallet --recov mode to do that and also an hex editor to search for the string but there is a few issue :

-When I launch pywallet --recov he ask me for the passphrase of the wallet but i'm totally unsure about the passphrase, would it affect the recovery if I put a wrong passphrase ?

-When i go for the search using an Hexeditor and searching for the sequences (as described there https://bitcointalk.org/index.php
topic=1983382.msg19785384#msg19785384) the hexEditor crashes probably because the .img file is around 300 Go any way to avoid that ?
-Is there any other way to recover that i didn't thought of ?

Thank you all in advance and have a great day.  Smiley
3  Bitcoin / Bitcoin Technical Support / Re: How to recover btc after windows reinstall on: February 07, 2023, 08:07:37 AM
-snip-
-snip- i decided to test it on a simple wallet that i created my self using bitcoin core "recent version" and it don't find the "0201010420" when I open it using Hex editor. So I have a few questions ...

1) Does the byte before the private key have changes with the version of bitcoin core that was use to create the wallet.dat ?
2) When you mean encrypted wallet you mean  the wallet as a whole or just the private key ?
- Those bytes will only appear on unencrypted "non-descriptor" wallet.dat files, however wallet.dat created by v23.0+ are descriptor by default.
For testing older wallets, create a new wallet but untick "Descriptor Wallet" during wallet creation;
In bitcoin-cli, it's the sixth argument of createwallet command which should be set to false: e.g.: bitcoin-cli createwallet "testwalletname" false false "" false false

- Bitcoin Core doesn't encrypt the whole wallet.
Otherwise, the user will have to provide the passphrase every time he needs to open/load an encrypted wallet.

Thank you for you quick response. Also my hdd disk image is around 300 Go and when i launch a search using whexeditor it crashes after a few hours do you have any  better software or other way to do this job ?
4  Bitcoin / Bitcoin Technical Support / Re: How to recover btc after windows reinstall on: February 06, 2023, 10:22:29 PM
Was the wallet encrypted (did it have a password)? If it wasn't encrypted then attempting salvaging the coins will be easier than if it was.

There is an alternative to using pywallet, but it requires more time and effort.

If it wasn't encrypted you could use a hex editor capable of searching a whole hard drive to search for this string of bytes 0201010420. The next the thirty-two bytes after that string could be a private key.

If you find one you can change it from raw hex to a normal format by pasting the thirty-two bytes into an offline copy of this webpage, which will also give you its associated address.

https://www.bitaddress.org/

This post explains how to use the webpage.

https://bitcointalk.org/index.php?topic=1961924.msg19522772#msg19522772

This hex editor is capable of searching a whole hard drive.

https[Suspicious link removed]ditor/

These screenshots explain how to open a disk, then search it for the hex string.

Click "devices", then "open disk device", then select the disk letter you want to search.



Click "edit", then "find".



This window should open. Paste the hex string into the the text box labelled "search", then click the button labelled "find all" and wait a very long time for it to search the whole drive.



If you try it run all software offline inside a virtual machine like virtualbox or vmware. Don't ever risk putting a private key on a computer that will ever be connected to the internet.

If you find any private keys you can install the electrum wallet and either import or sweep them into it using these instructions.

http://docs.electrum.org/en/latest/faq.html#can-i-import-private-keys-from-other-bitcoin-clients

http://docs.electrum.org/en/latest/faq.html#can-i-sweep-private-keys-from-other-bitcoin-clients

Electrum should sync almost immediately and give you fast access to your coins.

Don't ever boot from that hard drive again because doing so could wipe all traces of your coins.



Hello I recently find back an old hdd which was having my wallet.dat with a few bitcoin in it unfortunately it was partially rewritten with new data... but i still want to be sure the private key is not there anymore.
So before doing it on my disk image i decided to test it on a simple wallet that i created my self using bitcoin core "recent version" and it don't find the "0201010420" when I open it using Hex editor. So I have a few questions ...

1) Does the byte before the private key have changes with the version of bitcoin core that was use to create the wallet.dat ?
2) When you mean encrypted wallet you mean  the wallet as a whole or just the private key ?

Have a nice day Smiley
Pages: [1]
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!