Recovering an old corrupted wallet

[chiller]

So I managed to recover an old wallet.dat file from around year 2011 from an old hard drive (faulty but functioning one). The size of the file is 112KB witch seems normal for wallet files
Unfortunate but it won't load into any bitcoint-qt wallet (tried old ones too), it won't salvage either.

When I open the file it really looks corrupted (not like typical wallet.dat) with random characters all over the place - small snipet of few first bytes in the quote.

ãÿp¬Nb±ÕFê ‘û¼mÁ��TŢοT#¡Òb:JœEÔÍ5šJf^­:ÞJ".Ž²…Þܳ‹Üú鵯ɽeÔu=wÌÙ“ìj}ldÚ[’ÒJÞgwQlbyÛ¨[êÜÖÖ�†ü�r¶‘«$»Š
¡n5¨@%B�¼ï‘6ŸG$J1¡Û'j˜¦–“þdâé8³Õ–jdSõ‡©ÃR{ÂÉ¢ƒ:ë8   W*çè}NX7
àÆ3þêÅ¡2¶Ã�拾P@ò8íª¤õšMý,«š %êé5÷âäV(Ò¦…ãqA‡Là�ÕÒ}÷ß|àÜûï¾A”<Œæ¡©=>áÌ›í·½.39O­ži·)3�!w¶JI1ºÇnߎ   �ŽmøYÀb¶Š´�uš
÷¹µ7WÜ'p)õ*Ö»Šfö@ôFJm\*¸+à½,õA:5&KèŒ5 ÆÞóïH„iÿ«83 {ΦÞgPŽ!e-"Rg™m‹;¨F¤~ïüGkœ¬
w^ú΋9�Ú�w}…� r#mGè†ø-çy¡5ƘLÀDé¿ÞË �>£�‚j¼„d{óVÅNõmÓ5”¬/_97Q"Ü„€ÆUÜg ]i°f­ifú-çc*`ˆAÅ—Þi†tOM5{�>#ú
Š¼µ$L+m   ±›vž·ƒ
7:÷Ù†£ž?Ç|¬ãÈ>ΆÃs`öƉ}i‰Å±ûCšö|ûß}÷ß}·�Þí»2sè8ËÃ7iæí,Ô4YO³2LbŠ9�›ÒtNf¹/I©-@q÷ŸF‚“ïfïV£FÅ$|ßì]pO«Cz3,ÂtÜ3aÝ‘"3—ktrPlwÞ}¦šN66(MY–щݵz°Î¤¨†ÄÅùÝk‰€ÈÎŒ>µFÚS2fcðn³ËW±B†BÙõý·¹ÑÔc çI‹þXÅiàÇL¿ÑTê�­Ò”ã„îã<@/WqÅó­ñ!YÌÇq¹äÍóÆ·¤¿m�û5 ¸¿fî§g$ÜZ´È'/�¦­£¢tÔ3û•ðú´‡SGð‘_qbpÌÓþteõôœ3?ðÍ÷F4ëÄ+$xfòwÈêŒ)]¾ôûï¾/{ï¾û-ž%}÷wÝßy·Ÿ}$‰¤Á©)�ox+ƒ¦Ýu6`�{ÿyçݳï{ÚEFhÝåWçog{3¬~$a åß
â?ªóÄÑ}(Xâe¹ÚMöaV�lÑ.‚¼UCU…)½¼X¡
·Î5ÈÚ2Ê”ídL.¼îÑÒ$i
è|ÿ=è;Éï
Þñ»ádÜd’¯Ju ³ùÉÜEºL­

The system at the time was either win XP or win 7, and I'm not sure if the drive was encrypted (probably not because i saw all other files (portion of them was corrupted too) ). There's possibility it was encrypted somehow on top of the wallet encryption ( I was a real smart ass at that time ).
What I tired

• Various tools to extract private like "python keyhunter" and similar
• find some patterns or similarities in encoding with hex editor (manualy)
• search for magic numbers
• Maybe something else
• Tracking the transactions to/from this wallet by full node IP of the broadcast address and date(8/28/2011 last modified) but most trackers have data from 2013

I mean I don't really know how much of the coins left on that address.
So that would be a good start.

If anyone figures out how I could recover rest of the wallet I would share the wallet balance generously

[Lakai01]

I think you are right, this wallet is either encrypted or corrupt, the first few bytes you posted are definitly not "normal". You could try some de-/encryption tools which were standard back in 2011:
https://en.m.wikipedia.org/wiki/Comparison_of_disk_encryption_software

[NeuroticFish]

The only 2 things that come into my mind are
1. Maybe there was a cross-link and your real wallet data is somewhere else on the HDD - for this you'll have to search on all sectors - used or not - for the magic numbers.
2. The file is encrypted and then you'll have to think harder on what you've done back then. If you would have used Rar or 7zip for this I would have seen their signature, but I don't know what you could have been using...

[Lakai01]

What came to my mind is that eg. Electrum let you specify a password to further encrypt your wallet. May it be that you encrypted it that way?

[Jundax]

So whats the wallet balance anyway? Is it worth wasting someones time?
Or you dont remember and there could be a zero on account?

[chiller]

I think you are right, this wallet is either encrypted or corrupt, the first few bytes you posted are definitly not "normal". You could try some de-/encryption tools which were standard back in 2011:
https://en.m.wikipedia.org/wiki/Comparison_of_disk_encryption_software

Thanks, I will look into it.

The only 2 things that come into my mind are
1. Maybe there was a cross-link and your real wallet data is somewhere else on the HDD - for this you'll have to search on all sectors - used or not - for the magic numbers.
2. The file is encrypted and then you'll have to think harder on what you've done back then. If you would have used Rar or 7zip for this I would have seen their signature, but I don't know what you could have been using...

Yes i thought about that the file could be fragmented and stuff, but i don't have expertise for such kind of forensics.
Some image files that I recovered had this weird-glitchy vertical green lines almost as in VHS video tapes when you fast forward them but they open just fine.

What came to my mind is that eg. Electrum let you specify a password to further encrypt your wallet. May it be that you encrypted it that way?

Its possible but electrum wasn't around at that time, unfortunately.

So whats the wallet balance anyway? Is it worth wasting someones time?
Or you dont remember and there could be a zero on account?

Well I have tried to figure it out. Unsuccessfully.
There was >10btc at some point ( mining was easy, some foucets gave like 1 to 5 btc per claim etc).
If any one knows where i could look up data from 2011 and upwards by broadcast IP address it would help a lot to figure it out

[Lakai01]

Do you remember the wallet software you used back then?
Regarding the IP address ... if you still have the same router as in 2011 the router logs may contain this info, but I doubt it. Your ISP has such infos, too, but I dont think they keep it for that many years.