I have already used dumpwallet with pywallet on the recovered wallets I found with a full drive scan. This is a wallet.dat I found in a lost partition by using recovery software. The file won't dump like the other wallets, as I think it is corrupted, and shows as 96kb before using pywallets dumpwallet command. The resulting dumped wallet is only 32kb and says "wallet is encrypted passphrase is correct" but unlike the others it shows only one encrypted private key and nothing else apart from salt and a number. The one encrypted key is a different alphanumeric number to any of the other encrypted private keys I have recovered, so obviously it could be the one I'm after. None of the wallets are usable in the normal way in bitcoin core no matter what command you use as they are corrupted. I have used the passphrase on the other recovered wallet.dats and it shows all the addresses, private keys, mkey etc ie it decrypts the wallets.

Interesting, thanks for that. Wish I had the knowledge to apply it.

I have a wallet.dat file that I recovered from a hard drive using recovery software. I ran pywallet through it, and all it showed was one encrypted private key and a salt and I knew the correct passphrase, which I used . I have also used pywallet on the full 400G drive, and all those recovered files found by that method have included address, public key, master key etc. The lone encrypted private key is different to any of the ones found by doing the full drive search.

I have an encrypted private key and I know the passphrase, plus I have a salt. Is It possible to get the private key? It is from an old Bitcoin core wallet. Thanks for any help.

As part of an attempt to retrieve a Bitcoin wallet/private key from an old hard drive I have found a docx file labeled Bitcoin. It consists of 3 blocks of characters A-Z, a-z, numbers 1-9 and+/. Each block is about 70 characters long and about 50 lines deep. My question is, is this base 64 as it doesn't contain any = and how could I decode it? Do I need to know the start and finish of a string as It just consists of the large blocks of characters as described. Sorry for my clumsy explanation, but If anyone can give me a clue that would be great.

Yes, definitely a bitcoin wallet.dat but that is all I could recover. Is there a way of getting the WIF  private key from it?

So I recovered an old wallet.dat from a hard drive by using recovery software. The wallet is 96kb and I put it on a usb stick and ran a pywallet recovery on it. I knew the passphrase and used it, and the recovery completed fine. The result was strange as it said 0 wallets found 0 encrypted keys, 0 keys decrypted, passphrase correct wallet is decrypted. I then dumped the wallet using pywallet to a txt file but without the passphrase, just to see what it showed. What it showed was encrypted key 96 characters long numbers and letters and salt with a number, and nothing else that looked useful. Would this be of possible use to me? I know the public address that is of interest to me. Thanks if anyone can throw some light on it.

Sorry to ask, but what would be the correct command for using pywallet to scan a usb stick in G: and dump the output to screen only, assuming I had the correct passphrase. Thanks again. That's based on my messy directory setup.

Thanks again I don't seem to have put in the correct passphrase so far based on the ones I had been given when I ran pywallet on the hard drive originally. So if that's the case, then I need to quiz him some more as maybe pywallet could be worth another recovery shot?

It only gave me one address, it's the same one that shows when I click receive tab.

When I use listaddressgroupings it just returns [                                                                                                                                                                                                                       
                                                                    ]




 

Thanks, do I need to put quote marks around the passphrase?

I have found a Bitcoin Core version 8.5 and wanted to know a few things about console commands.
I have not let it start to sync as I have kept it offline thus far, but would like to know how to list all the addresses it contains. I have the passphrase and would like to know what to type in the console to show them and also to unlock it for a set time. Thanks for any help.

Not had any luck so far, still working through them. I did used some recovery software on the hard drive and found 2 copies of bitcoin QT version 8.5 each being about 21 meg in size. I opened one and it is locked but i don't know how to unlock it. It only gives me the option to change the passphrase and remains locked. Should the addresses be visible when it is locked and am i wasting my time? Cheers

Don't bother with those, use pywallet to scan a copy of the the whole drive and use the passphrase. Don't share the results with anyone.

If you have the passphrase why don't you run pywallet yourself and reveal those encrypted keys? With the very kind help of HCP i managed to get it running. Check out this thread. https://bitcointalk.org/index.php?topic=2398504.0

Just one thing before i call it a night (hard day at work) at the bottom after all the sets of addresses, encrypted private keys etc there is extra stuff like 64 character strings with the heading recovered. Is that normal? Thanks.

You're brilliant! I did what you said and looked in the pywallet folder, nothing. Then i looked in downloads and it was there on it's own and not within pywallet, weird Anyway i will have to go through all the addresses and check them on blockchain explorer and i have multiple wallet dat recoveries to check (different scans of hard drive with other passphrases he suggested to me) plus the partial recoveries to try. I will let you know if i have any luck and will be true to my word if by any chance i find some coins.

So i tried it and got a similar error to last time. I then unticked read only in the pywallet folder and something actually worked The thing is it's not set out neatly with the rows named as to what they are. It consists of (on the left side) lines of numbers and letters 42 long and below that line is a string of numbers and letters 34 long all starting with 1. These alternate like that all the way down the page. Over on the right corresponding to the lines starting with 1 it says recovered and a string of numbers and letters mainly 23 long and some 22 long.

C:\Users\Catherine\Downloads\pywallet.py
             C:\Users\Catherine\Downloads\pywallet This contains individual wallet files eg recovered_wallet_1511377727.dat plus others the same with different numbers. These are from different recoveries but in the same format including pywallet_partial_recovery_1512502528.dat for instance. This is a folder i created to receive the found results, it also has the db files i mentioned. In properties it is ticked as read only, if that makes a difference?