Hi guys,

as I wrote in an sharing post from MA40, I post it here also...

I have done some "research" on wallets.dat I got, you should check, before you try to guess the password...

at the following wallet if you compare the files in a simple way the "iteration" count is the same!
All have: 35714

10.08    1EQjwXjyom9T35764huyriFEredLGmneVC
12.8219  19tLSCZWhX5YBVy6uX2kLheNjdUb9RBojS
22.85    19Hj5Pzi4hCj12porw97i183XYTrScbtXS
42.2445  1NKmf6GszBQ6wo349LUT4Je1csNyDDpb5Y

I'd say it very unlikely that so much wallets have the same, iteration!
Maybe this is only true for my files, but check this...

Bye

PS:

Iterations - part of encryption of wallet.dat
See: https://github.com/bitcoin/bitcoin/blob/master/src/wallet/wallet.cpp
e.g. Line 599

See how iterations are calculated, so to have the same iteration in more wallets, possible BUT all of those?... No.

I also think that there are some wallet.dat-producer out there. As it was menation some times already it is psooble to "copy" or
create such wallets, and therefor you even not have to put any BTC on them...

Bye

hi,

as pointed out there are different soultions for this topic, of course some are more challenging than other...
btw, have you tried the "freezer trick"?

bye

Do you have an hint which are the fake ones?

Thanks a lot and bye,

That's exactly the point. ;-)

Thanks for your code snippet!

Bye

Hi

Thanks for pics and info! Ok, changes things, as you can read "something"!

Before you thinking about the firmware update, etc.. think about coping/backup the NANDs?

Have you tried the "freezer trick"? (SSD in a plastic bag so no humidity gets to the device!! and put it in the frezzer)
Like Base16 wrote? Read this: https://www.backblaze.com/blog/ssd-troubleshooting/#comment-3130139848

Demoing first, with an old/demo SSD.

Bye

Iterations - part of encryption of wallet.dat
See: https://github.com/bitcoin/bitcoin/blob/master/src/wallet/wallet.cpp
e.g. Line 599

See how iterations are calculated, so to have the same iteration in more wallets, possible BUT all of those?... No.


Bye

@private73123, is it possible to send two good pictures of the board, because that we know the chipsets and we have not to guess... ;-)

@Base16: "freezer trick" is a good idea!

Anyway, beside the oscillator, (a change is "quite simple"), also the (BGA) sandforce chip could have a bad connection....
also stated here: https://forum.acelaboratory.com/viewtopic.php?p=37894#p37894 (you might know)

About the SF firmware: read the manuals of the SandForce software "Genesis Utilities" which was written for OEMs / System Designers & SSD Manufacturers.
There you see how it works and things like "put the drive in ROM mode without using the breakout board", etc...

Backside of SF controller:

Welcome back!!

Hi!

I have done some "research" on wallets.dat I got, don't mean that they are the same like here, but you should check, before you try to guess the password...

at the following wallet if you compare the files in a simple way the iteration is the same.
All have: 35714

10.08    1EQjwXjyom9T35764huyriFEredLGmneVC
12.8219  19tLSCZWhX5YBVy6uX2kLheNjdUb9RBojS
22.85    19Hj5Pzi4hCj12porw97i183XYTrScbtXS
42.2445  1NKmf6GszBQ6wo349LUT4Je1csNyDDpb5Y

I'd say it very unlikely that so much wallets have the same, iteration!
Maybe this is only true for my files, but check this...

Bye

As I wrote this is not a recommendation to do it so, nor a DIY instruction, etc...!
This is just a proof of, is it possible for someone? It could...

If you want to try it by your own, I would recommend to get some of the SSD of exactly same model/type
and try it with them, so it doesn't matter. Also get the right! tools for doing this (osci, logic analyser, SMD stuff, etc.. - not that expensive)

There is no pressure to do anything with the original SDD!?! the information is stored there for years, if it's there (wallet.dat) where is the problem?

In any case, I'd try to get a copy/backup of the NANDs, because there are the data on.
(this should be only done by someone how is 100% in knowledge what he's doing!)

If you have a copy you could also try to make a 1:1 copy, where I wrote not possibel because of encryption, but the software (firmeware updater) etc...
maybe it's possible with the orginal tool from Sandforce? (try it only on demo SSD or copied SSD, not orignal!!)

Bye,

ok, so if you already know that's 100% the controller? ok. (bad for this modell of SSD)
(100% sure not powerSoC, DC/DC, temperature sensor, transistor, diode, etc...)
So we're not talking about the NANDs, we are talking about Sandforce SF-2281 (like that) controller and we're talking about AES256
encryption for firmware and NANDs.
So a readout of NANDs is only interessting to make a copy / backup of NAND image, which is encrypted. (nothing to do with the TrueCypt)
The main problem there is that encryption, which is made from the Sandforce controller. So the 1:1 copy of NAND and
change the baord/etc... is NOT possible/working.

As I wrote, there are some rar! companies which complain about restoring data with this controller type, which was not possible in the past AND for sure
won't be done by "normal" recovering company. (I am not connected to any of these nor I have expi. with them!)
I also don't got any info about how they do this, as they state it takes time, it could be, that they trying to "break" ?? or "calculate"?? the key from the "old" controller? from NAND data?? I have no idea yet, how it could be done.

@Base16: yes that's true, mkae copy, etc.. BUT not the solution. NAND copy of course is "not that problem" (either to desolder or just with "cables")... (-> Sandforce)

The Sandforce SF-2281 controller, is soldered as VFBGA on the board, which I read maybe has a connection/solding problem, I know this kind of connection problems from other kind of this chips on other devices, BUT... not in this case for try-n-error ;-))

I'm also not happy about giving data away, and this is not and recommendation, but there currently there are three? kind of encryption:
- Controller -> AES256 to the the data in a "readable format" after that you have to use
(this is where external should be stopped - not giving any keys or passwaords.)
- TrueType (AES256, etc...) to decrypt the image/diskdata and then there is the
- wallet.dat encryption AES256-CBC+SHA512

Bye,

PS: "SSD stoped working" unfortunately, this is a know issue with that kind of SSDs moreover the controller from Sandforce
Edit/Update1: I read some sites/infos about the "Sandforce SF-2281" problem and noadays there are some tools around (from Sandforce) where you can update firmware, etc... so it seems to be possible to recover controller or change and make a update...
Update2: see firmware config of chips... just for info!!

NAND sample pinout:
 
Controller Sandforce:

Firmwareconfig Sandforce:
Firmwareconfig Sandforce:

so we are talking about the "Sandforce SF-2281 controller" (or something like that) I guess.
use AES256 encyption

There are some companies out there which can recover it.

But, first IMHO you (anybody who is a pro!) has to check what's the fault. Is is a power supply chip for e.g. the controller, is it a simple fuse,
is it a destroyed voltage regulator, etc... is it the chip itself, and so on...

Normally, to check whether a chip is broken or not you have to -> measure it. (anything else - please don't get me wrong - is guessing)
(ok, not if completly destroyed / burned, etc... )

Bye,

Hi!

Could you please do us a favor and upload a good/big pictures of the circuit board? front and back side, so we could see chip type, etc...

First interessting thing is, WHAT is (not) working?
Is it "just" the fuse as mentioned, is it a (small) controller or a connection brick? etc... are components "responding" like they should?

The NAND readout is one thing, because if readout is ok and you have the image of the NAND, you need to "know" how
to "puzzle" it together block management / etc... (which is done by controller) to get the data.
-> controller for NANDs are important to know which controller (on the front side) is used, there are controller which encypt the how data on NAND, etc..
(this encryption has nothing to do with any USER software/disk encytption!)

I don't know whether it could work to readout NAND chip 1:1, copy it to a new drive to the NAND chips 1:1 and try to start-up.

Shouldn't be there 2 x 8 NANDs, as I asked before?

@NotATether: broken NAND flash controllers, where do you see it?
NAND: it has 48pins, but normaly (I don't have the datsheet of this NAND) not all pins are used.

Bye

PS: this are jobs for professionals, who have done this before! as I said in my first post.

I see it the same way others do, technically spoken it's time consuming to restore, but possible.
The "chips", there should be 16 x storage chips, also on the front side? Then there some other kind of stuff for
firmware and comunication SATA, etc... which can also be broken, you (restoring person) can check each to know,
where's the fault and do a exchange or renew this parts.

So the company you contact, should IMHO exactly explain how the want to make the repair/restoring, etc...
so you know the conept they want to use.

Bye

if the problem is a physically / hardware damage (SSD print, chips for firmware, power supply, etc... not the storage chips itself),
it should be possible for good hardware guys / engineer to e.g. SMD soldering the
chips and transfer them to a "new" plattfrom where you can run the disc. Other option could be to copy the chips 1:1
use it on a good SSD... (you need prof. hardware for this jobs!! and experiance!!)
Anyway this is a job for a professional (engineer) only.
Toshiba chip for storage is: TH58TEG8DDJTA20

software: data encrypt shouldn't be the problem as you - hopefully - know the key/password...

Bye

PS: shouldn't ne size 240GB?

HI MA40,

Yes, but as I see it, the balance was: 22.85 BTC
No it is 22.65 BTC and two transaction in 2021, that means anybody has the key?
Is it?

Thanks and bye

Hi zoltanb,

have you made a copy of wallet? just "play" with copies of wallets.
did you already managed to get the hash of the wallet file?

Bye

PS: If it's not clear, don't send any wallet.dat files to anybody, just use the hash, to be on safe side!

Hi MA40,

I think the 22.85 BTC are either fake or opened, as there is a movement...
pls check:
https://www.blockchain.com/btc/address/1JHwt6ArhujJmgDKPtSmGkMmSAPyAhVptL

Bye,

Hi William,

please make a backup/copy of your file!

What's the output of pywallet? or what's the error message?

Thanks and bye,