Thank you for the replies.

@Cricktor, I have used r-studio on MacOS to create byte-by-byte images of the drives then I proceeded to mount those and scan those to recover files.

I was able to make pywallet work on my new airtight mac and ran all but one of the wallets through it with no success of it finding anything. Currently in the process of recovering files on my last harddrive image copy in hopes that something comes up. The wallet I'm searching for realistically was in a windows 7 account that was deleted and I'm hoping to recover that somehow but it seems that pywallet --recover is only helping but so much

@bulleteyeddk I need to put that into chatgpt and figure out how to do that. that is my next step. is that a search i do on the .dsk image file or on the folders containing all the files?

Thanks again guys!

Thank you for this. It seems X-Ways Forensics does not run on mac but after a bit of research (read asking chatgpt haha) it seems I can use the .dsk image files of the original drive and search for the aforementioned Hex Headers using a grep or python script. I can also search through the recovered files using a hex editor. If i get any hits, then I guess I will see the next steps

Thank you for the response!

There is a good chance they might have been deleted since my account was deleted on the family computers at least in two different occasions.

Do you have more intel on how to search for the hex values. This is all a foreign language to me as of now and ChatGPT has been my savior/guide thus far.

Hi All,

So i finally was able to get access to 4 hard drives (from different family and personal computers) that I used in my younger days where I recall dealing with bitcoin. I don't recall ever mining it myself but receiving some from users in a forum I was an admin of. Now I am trying to get access to it and unfortunately lost. I am 99% certain there is bitcoin that I had somewhere on these drives (and hopefully not on a website?)

I have used this forum and ChatGPT to get to a certain point but I do need guidance like a 5 year old. Any help would be greatly appreciated.

For point of reference, I am currently using a Macbook connected to the internet (will refer to as MacInt) and a Macbook that is brand new and was never connected to the internet (will refer to as AirtghtMac).

The AirtightMac is where I want to do all my recovery. This is running on a M2 Chip running macOS Sequoia 15.1.

These are the steps I have taken so far, please point me in the right direction how to proceed or if I did anything wrong.

- Loaded all 4 old hard drives one by one on r-studio on MacInt, created images and restored all files in 2 separate external harddrives.

-In AirtightMac, I installed Python 3.9.13 as it was the earliest one the Mac would install without Rossetta or an Internet Connection

- In AirtightMac, I was able to successfully install PyWallet 2.6.1 after I added the Berkeley DB files and modifying the code pywallet.py as needed. I found out that PyWallet was not made to work with Python3X.
This took a better portion of 10 hours for me as I have no experience in python, Terminal (for mac), or any of this stuff but ChatGPT was a major help and walked me through everything. After a grueling day, I was able to get PyWallet to run successfully on the AirtightMac.

- I confirmed PyWallet was working by running: python3 pywallet.py --help and getting the usage instructions.

- After attempting to run python3 pywallet.py --recover --recov_device=/Volumes/Drive1 --recov_size=50G ChatGPT informed me that this would not work with versions after Python3x or newer.



I so far have run the following searches/commands without yielding any positive results

- find /Volumes/ExtHD -type f -name "wallet.dat" 2>/dev/null

- sudo find /Volumes/ExtHD -type f -name "wallet.dat"

- sudo find /Volumes/ExtHD -type f -name "*.dat" This one gave me 100s of results but nothing that I thought was correct

- sudo grep -r "5[HJK]" /Volumes/ExtHD > /Users/me/pywallet/private_keys_found.txt followed by grep -Eo "5[HJK][a-zA-Z0-9]{49,51}|[LK][a-zA-Z0-9]{51}" /Users/me/pywallet/private_keys_found.txt

- I then ran find /Volumes/ExtHD/HD1Image -type f \( -name "*.dat" -o -name "*.bin" -o -name "*.key" \) > /Users/me/pywallet/hd1_encrypted_wallets.txt


- find /Volumes/ExtHD/HD1Image -type f -exec xxd {} \; | grep -E "5[HJK][a-zA-Z0-9]{50,52}" > /Users/me/pywallet/hd1_hex_keys.txt

- grep -Ero "[13][a-km-zA-HJ-NP-Z1-9]{25,34}" /Volumes/ExtHD/HD1Image > /Users/me/pywallet/hd1_wallet_addresses.txt

All these so far have yielded no results, granted I am only on the first of 4 hard drives.


It seems that I have not really used PyWallet yet despite downloading it and tweaking to make it work. I am not sure if Im doing the right steps and what my next steps should be. Any help would be greatly appreciated. Thank you.