Thanks EFT & HCP.
I will check out GNOME for a byte for byte copy, can you recommend any Linux live that comes with drive recovery/forensics? and are these programmes any better than Recuva, Steller, Get data back etc.
Ref KingZee wallet finder and PyWallet, do they both look for deleted files and/or parts of files if semi over written? I would like to get PyWallet working in Linux but I am having a hard time I am wondering if it is because I am using the newest Jack Jack but on python 2.7.
Quote
The tool is simply trying to find the "key" markers by searching your entire drive... then it attempts to extract the raw bytes at this points and then puts them into a new "wallet.dat" (ie. the recovered-wallet.dat file) as the private key...
As such, the markers you are seeing (magic bytes and bestblock etc) are likely the ones placed there by the recovery tool when it created the recovered-wallet.dat Undecided
As such, the markers you are seeing (magic bytes and bestblock etc) are likely the ones placed there by the recovery tool when it created the recovered-wallet.dat Undecided
I will likely get the Core just to be sure, however as the wallet-recovery I was using seems to spit out 0000's I am wondering if HCP is correct and these magic numbers are actually a cause of the wallet recovery rebuild... that said what did it pick up in the first place could it be a false positive or an encrypted wallet hence 000's? maybe there is a reason to use PyWallet against this drive, perhaps it might be better extracting the key?
As always thanks for your help.
Dan