Lost 65BTC, looking for advice.

[rromanchuk]

Around 5 months ago, my friend received 65BTC  http://blockchain.info/fb/1hg6a4 for services rendered. Recently he approached me to help him get his bitcoins because his btcoin-qt client kept crashing everytime he tried to open the application. I figured it would be about a two minute fix to run a rescan/resynchronize to to clean up a minor corruption.

After taking his wallet.dat I noticed the only address associated with it was 18nPHGz1B4Hrww7wn5qwj8we6s9WL1hL74, not the address he received payment on. I tried to gather the timeline of events as best I could to figure out where he even got 1HG6A4fCnVEKR25T9GgVxH9vVyTv5eLn87. From what i can recreate, at some point in time, he opened his bitcoin-qt client and copy and pasted his address that was displayed and sometime shortly after bitcoin-qt crashed and never could be reopened. Fastfoward to where we are today.

I assumed somehow his wallet.dat was deleted, overwritten, or something. He's on a 60G @ /dev/disk0 mac book air, solid state, but since it has been 5 months since the transaction, the chances of recovering this private key seems very slim.

I attempted to recover using pywallet, and it wasn't to recover any full wallets, but it did leave a recovered_wallet.dat with some data, but when looking  at the hex nothing seems relevant to a private key. (from what i gathered i should be looking for)

I also tried using photorec with no success.

I have not tried https://bitcointalk.org/index.php?topic=25091.0  because i wasn't sure how to build the binary for a mac os machine.

Is it time to give up?

[1714002541]

1714002541

[1714002541]

1714002541

[1714002541]

1714002541

[Luckybit]

You have no idea how much money you lost...  

[FTWbitcoinFTW]

Lost coins only make everyone else's coins worth slightly more.  Think of it as a donation to everyone

[vm1990]

depending in how much he uses the lapto depends on the chance of success if hes moving lots of data constantly then its very very small chance but there are 100s of programs out there to try even more if you use torrents XD

id just keep trying different programs its going to take a while but if you find a good software recovery program you should be able to find it EASEUS is pretty good but costs try cnet.com and look through free recovery programs

[.m.]

you pointed to the right thread, but did not read instructions :

Instructions:
<BOLD>Stop using your computer until you've recovered your data, in case something overwrites it. Shut down the PC as soon as possible.</BOLD>

Obtain a suitable 32-bit Linux LiveCD


.. so you run it through Linux LiveCD, not MAC or anything


get e.g. live Fedora
http://fedoraproject.org/en/get-fedora

and this one creates bootable USB stick from CD image
http://unetbootin.sourceforge.net/

or follow this OS X guide :
http://www.ubuntu.com/download/help/create-a-usb-stick-on-mac-osx

[rromanchuk]

Will give this a shot next, thanks.

you pointed to the right thread, but did not read instructions :

Instructions:
<BOLD>Stop using your computer until you've recovered your data, in case something overwrites it. Shut down the PC as soon as possible.</BOLD>

Obtain a suitable 32-bit Linux LiveCD


.. so you run it through Linux LiveCD, not MAC or anything


get e.g. live Fedora
http://fedoraproject.org/en/get-fedora

and this one creates bootable USB stick from CD image
http://unetbootin.sourceforge.net/

or follow this OS X guide :
http://www.ubuntu.com/download/help/create-a-usb-stick-on-mac-osx

[HCP]

I wonder why someone would send a small amount recently, for what purpose

It's a "dust attack"... they've obviously identified some addresses with "high balance"... and dropped in a small dust amount hoping that they'll be able to trace/track the ones actively being used and possibly identify the owners through chain analysis etc.

refer: https://www.google.com/search?q=bitcoin+dust+attack

[RickDeckard]

I wonder why someone would send a small amount recently, for what purpose

It's a "dust attack"... they've obviously identified some addresses with "high balance"... and dropped in a small dust amount hoping that they'll be able to trace/track the ones actively being used and possibly identify the owners through chain analysis etc.

refer: https://www.google.com/search?q=bitcoin+dust+attack

Around 5 months ago, my friend received 65BTC  http://blockchain.info/fb/1hg6a4 for services rendered.

LOL... no he didn't...

I'm sorry to doubt you @HCP but isn't "around 5 months ago" actually correct since the original thread is back from 2013? Or I'm making some kind of dumb assumption and I should be ashamed of myself?

Still it's sad to know that those BTC are forever frozen in time... It's like OP took them into a cryogen bath to never recover from ...

[HCP]

I'm sorry to doubt you @HCP but isn't "around 5 months ago" actually correct since the original thread is back from 2013? Or I'm making some kind of dumb assumption and I should be ashamed of myself?

Oh wow... how did I not even notice that? LOL You're quite right... it would indeed be correct.

iq_armando necro'd this thread so that it showed up on the "first page" as having a recent reply (and subsequently deleted their post)... and I didn't even check the OP post date... #whoops!      

Time to let this thread go back to "sleep"

[Porfirii]

You have no idea how much money you lost...  

INDEED!!

Time to let this thread go back to "sleep"

Yes, you are totally right, sorry for the inconvenience but I could not help myself commenting. Nobody had real idea back in 2013. More than $2M ...

[aoluain]

I wonder why someone would send a small amount recently, for what purpose

It's a "dust attack"... they've obviously identified some addresses with "high balance"... and dropped in a small dust amount hoping that they'll be able to trace/track the ones actively being used and possibly identify the owners through chain analysis etc.

refer: https://www.google.com/search?q=bitcoin+dust+attack

Sorry to chime in on this, but the "dust attack" is interesting. I read about it on medium and
I'm still learning about this.

I mportant factor which we should always consider for privacy is to use a new address
for new transactions, would this help prevent identification from an attack?

[iq_armando]

I'm sorry to doubt you @HCP but isn't "around 5 months ago" actually correct since the original thread is back from 2013? Or I'm making some kind of dumb assumption and I should be ashamed of myself?

Oh wow... how did I not even notice that? LOL You're quite right... it would indeed be correct.

iq_armando necro'd this thread so that it showed up on the "first page" as having a recent reply (and subsequently deleted their post)... and I didn't even check the OP post date... #whoops!      

Time to let this thread go back to "sleep"

I did not delete my post, the forum moderator deleted it ........ but it seemed interesting to me that those 65 BTC will never be recovered, in 2013 they were worth about $ 6,500 dlls, and now they are worth about $ 2,210,000 dlls. 

Anyway