[Bounty] 2 BTC - corrupted wallet recovery!

[LeChatNoir]

Hi guys,

i'm trying to recover some of the private keys contained in a corrupted NMC encrypted wallet.

I know the passphrase.

I've already tried with this tool https://github.com/jackjack-jj/pywallet and the following command:

sudo python ./pywallet.py --recover --namecoin --recov_device /path/to/corrupted_wallet.dat --recov_size 1Mo --recov_outputdir /home/username/Desktop/recovery

No success!

I've also tried to open and read the wallet with an hex editor to see if i could somehow understand its structure and isolate some private keys but i couldn't really understand anything of that, i can see only 8 "ckeyA" strings are present but NO "mkey", the file looks badly corrupted but only one private key contains namecoin so maybe i can recover that one only.

I'm willing to reward with 2 BTC if someone helps me to recover the private key i need.

I'm posting in the bitcoin section because i think NMC wallet format is the same as BTC wallet format, i hope this thread will not be cancelled or moved,

If you need further information please ask.

Thank you.

[1713307922]

1713307922

[1713307922]

1713307922

[1713307922]

1713307922

[1713307922]

1713307922

[hardshot]

Have you tried to start the qt wallet with '-salvagewallet' or '-repairwallet' parameter?

[NeuroticFish]

Long time ago I've seen this thread and bookmarked it. Maybe it helps. https://bitcointalk.org/index.php?topic=22697.0
If you already started on the hex path, this shouldn't be hard to check if it's good for you or not.
Good luck!

[LeChatNoir]

Have you tried to start the qt wallet with '-salvagewallet' or '-repairwallet' parameter?

No luck   

[hardshot]

Do you know what may have caused the damage?
Is your HDD slowly dying?

[LeChatNoir]

BTW i found  8 "ckeyA" strings inside my wallet, the problem is my wallet is encrypted and i don't know how to extract the private keys from those fragments of text and i don't even know if that's all i need, together with the wallet password, to restore at least those 8 private keys.

[laugh2btc]

Maybe this: (2nd post)

https://bitcointalk.org/index.php?topic=1404609.0

It´s the same way you posted on op, but maybe you ll find a mistake in your command or a hint to solve

[LeChatNoir]

Do you know what may have caused the damage?
Is your HDD slowly dying?

The NMC client and the encrypted wallet were stored inside the encrypted Ubuntu home directory of a linux installation running inside a virtualbox virtual machine.  
Last month i decided to format my computer, before doing that i copied the virtual machine file .vdi on an external NTFS hard disk.
At some point the fu.cking linux showed the copy process as completed, the .vdi file was shown inside the external HD and i stupidly decided to unplug the USB and format my computer.
When i later tried to restore the .vdi file, i remount the external HD with the backup and i found out the .vdi file i needed was not there anymore, it has never been copied apparently.
I did a recovery of the ext HD with photorec, it has found some .eCryptfs files that i succesfully mounted and decrypted.
Now amongst these files i have found 1 that is very similar to an NMC encrypted wallet but it has only 8 "ckeyA" strings inside instead of >100 so i think i have my severely damaged NMC wallet.
I couldn't find the mkey record inside that file which i don't know if necessary to decrypt btw, can i recover some private keys from what is left of my original wallet?  

PS: before you suggest, trying a recovery from the original HD is impossible at this point, i formatted my computer more then one time and at some point i've also filled my hard disk with new data.
 

[LeChatNoir]

Maybe this: (2nd post)

https://bitcointalk.org/index.php?topic=1404609.0

It´s the same way you posted on op, but maybe you ll find a mistake in your command or a hint to solve

I've tried to use the pywallet utility, i've also tried to recover keys from a new working NMC encrypted wallet but for some reason pywallet doesn't seem to work with NMC wallets at all, corrupted or not.

[laugh2btc]

Ask this guy (he´s online atm): He posted this: https://github.com/jackjack-jj/pywallet

https://bitcointalk.org/index.php?action=profile;u=21053


good luck!

[jackjack]

Hi!
Try this without --namecoin:

sudo python ./pywallet.py --recover --recov_device /path/to/corrupted_wallet.dat --recov_size 1Mo --recov_outputdir /home/username/Desktop/recovery

What does it return? What is "no success"?
And how did you find 8 "ckeyA"? How many "ckey" do you find?

[LeChatNoir]

Starting recovery.

Read 0.0 Go in 0.0 minutes

Found 1 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys

Possible wallet #1
    with passphrase #1  

All the found encrypted private keys have been decrypted.
The wallet is encrypted and the passphrase is correct


Importing:


The new wallet /home/username/Desktop/recovery/recovered_wallet_1476451765.dat contains the 0 recovered key



This is the output of pywallet with a valid NMC wallet!

I opened the corrupted wallet with an hex editor and found 8 ckey only and no mkey

[NeuroticFish]

Since your bounty is quite consistent, I would assume that your wallet is pretty fat one, so I can assume that you will try all the possible options..

I've read that wallet.dat is a Berkeley DB file. Maybe get the Oracle Berkeley DB files and see if db_dump works or maybe try a db_recover on the wallet file and then try again with pywallet.py
I didn't want to install anything so downloaded the zip from Oracle and I compiled it myself. On my wallet the db_dump worked, just it obtained a lot of .. lines which have to be further decrypted (hence the pywallet is still your friend).

Again: you may need to do a db_recover.

[spartak_t]

Just fork the coin.

P.S. Just kidding. Good luck with that, because I suppose you are in tough position...

[innominatus]

subscribed. intrested how it ends. wish you best luck recovering all your money

[jackjack]

Oh wait, I didn't notice that, this is no good: --recov_size 1Mo
You must put the size of the hard disk in --recov_size, and I bet it's more something around 500Go

You must put at least the size of the file, is your wallet.dat really <1Mo?

[LeChatNoir]

Oh wait, I didn't notice that, this is no good: --recov_size 1Mo
You must put the size of the hard disk in --recov_size, and I bet it's more something around 500Go

You must put at least the size of the file, is your wallet.dat really <1Mo?

It is 135 kb.
Is having the mkey necessary to decrypt some private key?
Because if that parameter is necessary we'd better stop here since i can't find it in my corrupted wallet.

I've found this guy https://bitcointalk.org/index.php?topic=398155.0 had to change something in the pywallet script to make it work with litecoin, maybe i need to change something too?

[jackjack]

Oh wait, I didn't notice that, this is no good: --recov_size 1Mo
You must put the size of the hard disk in --recov_size, and I bet it's more something around 500Go

You must put at least the size of the file, is your wallet.dat really <1Mo?

It is 135 kb

Isn't that small for a wallet file?

BTW in Pywallet I have hardcoded formats for ckeys that could be different from Namecoin, if you're OK you can send me your wallet (it is encrypted I can't use private keys) and I'll try pywallet without checks to see what I can find.

[jackjack]

Oh wait, I didn't notice that, this is no good: --recov_size 1Mo
You must put the size of the hard disk in --recov_size, and I bet it's more something around 500Go

You must put at least the size of the file, is your wallet.dat really <1Mo?

It is 135 kb.
Is having the mkey necessary to decrypt some private key?
Because if that parameter is necessary we'd better stop here since i can't find it in my corrupted wallet.

Are you 100% sure you don't have mkey? Because "Found 1 possible wallets" means pywallet found 1 mkey

[jackjack]

I've found this guy https://bitcointalk.org/index.php?topic=398155.0 had to change something in the pywallet script to make it work with litecoin, maybe i need to change something too?

No because in his case pywallet found the keys