This is SO cool! 

Will def. be following this thread, as it seems you have much more in the pipeline in this proof-of-work simulation game...

Just recently noticed this topic, and have been looking a bit into it the past days

It seems the 8 char length has been completely searched if im not wrong?

The PC used to create the password from random.org back in 2015, is that still around, if not maybe the harddrive running the OS is?
Im not familiar with the web response from random.org back in 2015, but maybe something was revealed in the URL about the generation of the password, i think this could be worthwhile to look into, given the BTC amount.

I know this is an old post, but somehow it slipped my attention, and i've just seen this now.

Have you ever considered a forensic examination of that PC you used whenever you had access to the wallet?
And have this password ever been used anywhere else?

I know chances of finding anything now if the PC has been used since 2016 would be very slim...

I've just downloaded the windows version, running on windows 11.

I think there might be a bug, as I added the following addresses:

1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa (received reward for mining block #0)
12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX (received reward for mining block #1)

None of these addresses show any balance in the app, where as according to both mempool.space and blockchair.com they have a balance larger than zero.

Im connected via VPN, maybe this is an issue?
Since i know each address should have a balance, i tried the "updating balances" button, but it returned a 430 (unknown status) error.

Look at my previous post, try and hook up with that dude that runs that YT channel, i would consider him being an expert within using BTCrecover and recovering funds in general.

Best of luck! - i really hope you get this resolved

Since you're carving in unallocated area, there is a risk that the file was fragmented, and the information about where each fragmented part of the file was stored on the harddrive is no longer available as that was stored in system files from the previous file system.

If this is the case, you need more advanced tools like x-ways, and still with a tool like that, there really isnt any guarentee you can ever recover a fragmented file 100%.

Another thing is that whatever part of an old wallet.dat file you're able to locate, that data can also be partially overwritten by other data.
Recovering files from unallocated area can be tricky if the medium has been overwritten with other data and been used since the time of deletion.

I'll be more than happy to help you, as you get this recovery going, but lower your expectations - I think there need to be some luck involved with the backstory you have told, chances are slim of getting that wallet.dat file recovered fully, but i agree you need to do whatever you can to know if anything is possible.

I have zero experience with the open source softwares mentioned, so how they should be used with regular expressions searches i really don't know

These are the open source tools i mentioned, i've never used them, but according to information, they should be able to search using regex:

https://www.autopsy.com/
https://www.sleuthkit.org/



1.X-ways is not freeware, and it's quite pricy
2. To verify the header of a newly generated wallet.dat file, you really only need to look at the file in a hex viewer, skip all the other steps.
3. I'll be happy to guide you, if you get x-ways up and running

The XML file you refer to is a R-studio file (known file type) - I would'nt be able to know if it was right, as I do not use that software, however you can give it a shot and send the one you created but i will need another XML file that works, and have that as a base reference.

Since you're using R-studio, maybe try and search for other deleted files you know should be there, it could be an image or a document

X-ways Forensics is way more advanced than R-studio.
That being said, i've only used R-studio once some 5-6 years ago, when i tried it privately.

Maybe give the open source tool a chance, i think they are capable of doing what you need.
There might be a difference in the way each tool is using their regex syntax, the ones i've written in the last post would work for X-ways forensics.

The hex values of the wallet.dat headers I did have some older versions myself, and used them at first to verify.
I asked Chat GPT for every variant of the wallet.dat files from all versions, and it came up with the ones i did not already have myself.

EDIT:

YES, \x is used by X-ways when doing regex searches with hex values, so maybe other tools just used the hex value, you will have to maybe do some test searches to verify that


Image below is the search window in X-ways, in this search i've chosen to search in all objects in the volume (all logical + unallocated area)
Regular expression selected, and the regex search it self.





YES is does seems like R-Studio uses the same hex syntax as X-Ways
Try and follow the guide you linked to, and create a custom signature with the regex information I posted earlier.
The signature is the header, there is not any known signature for the files end, so it needs to be empty i would assume (this is very typical, not to have an ending signature)

check this YT channel, this dude has a lot of videos using btcrecover - you can comment on his most recent video or read his information, there should be information about how to get in contact with him, if you need help getting onwards.

https://www.youtube.com/@CryptoGuide

EDIT: my previous post was deleted by a moderater, im not sure why, so i've withheld some information in this post

I've been using X-ways Forensics since 2011, with a tool like this you would be able to search with regular expressions in the unallocated area of a harddrive.
https://www.x-ways.net/forensics/index-m.html

My approach would be to search for the header of possible deleted wallet.dat files with regex searches in unallocated area, swap files etc.

Regex searches in X-ways forensics for each header type:
2009-2012 wallet.dat file header:
\x00\x05\x31\x62\x00\x00\x00\x02

Slight change to wallet.dat file in 2017:
\x00\x05\x31\x62\x00\x00\x00\x03

With Bitcoin core 0.18.0 in 2019, the header changed once again:
\x00\x05\x31\x62\x00\00\x00\x03

With Bitcoin core 0.21.0 in 2021 and onwards to today, the header changed completely:
\x53\x51\x4C\x69\x74\x65\x20\x66\x6F\x72\x6D\x61\x74\x20\x33\x00


If you're not able to get a license for X-ways Forensics, you could take a look at Autopsy -> https://www.autopsy.com/ or the Sleuth Kit -> https://www.sleuthkit.org/
I've never used any of these, but it seems both tools are free to use, and they may also be able to perform regex searches.

Follow Mitch Ray on YT and watch his livestreams, this dude does not have any deals with exchanges or any sponsors.
I've been learning from him since 2017, and in my opinion, he is great at what he does.
Also he is very honest when asked about any trade setups from users.

He runs his own discord, it has a paywall if you want the extra juicy trade setups before anyone else, but none the less, it also has a free section that has great values for anyone into trading.
This is his latest YT stream -> https://youtu.be/sODV9Fp7HNg

You're right  

It's been some time since i've used PGP, so this task was actually fun, thanks for a great initiative

The signed message is INVALID

I imported your privatekey, verified that your fingerprint matched the value posted in this thread.
I then verified the signed message, which returned as an INVALID signed message from satscraper_new@mail

Attached is a saved screenshot from every step mentioned, please note my layout is in Danish.
I've removed the commands from the screenshot, so others just can't copy  

I've just sent OP a mail containing a veracrypt container of the recovered zip files (198)

I would have sent the files through gmail packed with winzip, but gmail found virus in the zip files, so that wasn't a possibility.
So for anyone looking into this, just be careful with any recovered files, as they may contain virus.

I have not extracted any of the zip files, only touched them to see the content, none of the zip files has content related to bitcoin.

Maybe this is the wrong DVD ?

Many of the files recovered has timestamps from 2016 and 2018, which they should'nt have according to your memory
I can provide the recovered files for you, reach out to me in a direct message with a mail address i can send the files to.

EDIT: i've not seen anything related to bitcoin, and also not any password protected archives

I assume the archive type used is .zip ? you did not mention.
I've managed to carve through the content, and i've not found anything related to bitcoin, yet.

From testing zip and rar files with both normal archives and encrypted with password, some of the content should still be possible to read in hex, at least that was possible for me when i tested with just a .txt document inside a test zip and rar archive.

I've had no luck finding any password protected files (the 2 types possible to create in modern day zip)

Is the file you're looking for named: recovery.txt ? i've found information about a file named that, that file was created in july 2017

Since you wiped your harddrive (overwriting all data on the harddrive) you're out of luck, it is by no means possible to recover the previous data with your privatekey information.

If you had just formatted the harddrive instead, a recovery would most likely have been possible.
Sorry for your loss, deal with it and get on with your life... start stacking again

Since you have already been watching some youtube videos on the matter of how to use btcrecover, and still have difficulties using it, i can advise you to take a paid private session with cryptoguide.tips
He will def. be able help you with this recovery

He also haves a YT channel with lots of content of how to use btcrecover, i've never used his services, but i've never heard anyone talk bad about this person.

https://cryptoguide.tips/recovery-services-consultations/
https://www.youtube.com/@CryptoGuide


If you prefer to still recover this by your self, this may be a much needed ressource:
https://btcrecover.readthedocs.io/en/latest/

Since you're searching for deleted files, you're best bet is to search in unallocated areas of the harddrive, I really can't remember if R-studio offer that kind of search, but as it's critical for you to find this, I would just search the whole harddrive, it takes a bit longer, but at least you know, you have been through the whole harddrive searching.

With that specific regular expression we're trying to find the header of a wallet.dat file, if your search returns some hits, you need to figure out your self where that piece of file ends and export it as a wallet.dat file.
As with deleted files, they can be somewhat overwritten by other data, as this area has been marked as empty for the operating system to write files.

This is why it's so important not to use such a harddrive anymore, as data can be written just in the area where important data is stored.

If I may add to my previous post about searching for a wallet.dat header in unallocated areas, I think you may actually be better off by removing a few hex bytes and edit that regular expression to be:

\x00\x05\x31\x62\x00\x00\x00\x01

Using this should catch all variants of the wallet.dat header, sorry I didn't catch this in the first post.