Bitcoin Forum
November 23, 2017, 09:48:01 AM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: REWARD. Help with Multibit 0.4.23 Mac, Deleted wallet  (Read 1487 times)
msherwood
Newbie
*
Offline Offline

Activity: 3


View Profile
April 09, 2013, 07:40:44 PM
 #1

So, my roommate just totally f*d up yesterday. He is using multi bit 0.4.23 on a june 2012 15" stock MBP os10.8.2. He had a wallet with 200 bitcoins. He sent 50 to a new wallet, and without thinking immediately deleted the change wallet, essentially losing 150. He shut the computer down, flipped out, and was sedated. I'm helping him, and have spent last night and today searching mostly this forum for answers. I target disk his machine, then created a disk image from his HD. I ran Boomerang data recovery on the image using a user created signature from .wallet and .info files in library/application support/multibit directory. I have 23 .info files recovered, ~13MB. I'm not an expert on bitcoin, and am not sure what to do next to restore his .wallet. I found some info here https://bitcointalk.org/index.php?topic=25091.0 regarding recovering .wallet files in linux, and am not sure how portable these utilities are to mac os. If you are able to help, i'm sure my roommate will make it worth your while and send some BTC your way... I have some questions i'm not 100% on yet.

1. Does Multibit secure delete wallets, and if so is this the territory of forensic data recovery only?

2. Is all i need to find to restore the wallet the private key, and if so where would multibit keep that? It is a 51 digit number that begins with a "5," would this exist in any log or .info file?

3. How many days should i keep my buddy sedated before worrying about benzo withdrawals? ...joking

Thanks in advance to everyone. Anyone who wants to admonish my roommate feel free, though once he comes to he will be admonishing himself plenty.
-mathew
1511430481
Hero Member
*
Offline Offline

Posts: 1511430481

View Profile Personal Message (Offline)

Ignore
1511430481
Reply with quote  #2

1511430481
Report to moderator
1511430481
Hero Member
*
Offline Offline

Posts: 1511430481

View Profile Personal Message (Offline)

Ignore
1511430481
Reply with quote  #2

1511430481
Report to moderator
Join ICO Now Coinlancer is Disrupting the Freelance marketplace!
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
pheaonix
Sr. Member
****
Offline Offline

Activity: 392


http://casinobitco.in/ A+ customer support


View Profile
April 09, 2013, 08:13:54 PM
 #2

1. likely no.
2. yes. with this and some googling you will be fine.
3. my expertise is actually in neurology. it depends on his weight, but assuming a xanax bar per 8 hours, he will start to be susceptible to decent withdrawals within 3-5 days.

if you need further assistance i will be happy to help, i wish you good luck recovering that fortune.

BTC.sx - Leveraged Bitcoin Trading. Simply use Bitcoin to take advantage of a rising or falling Bitcoin price.
lbr
Sr. Member
****
Offline Offline

Activity: 389


View Profile
April 09, 2013, 08:18:42 PM
 #3

Whatever you do, don't write any data on the HDD from wich you will be recovering from.
You need to plug it in the different computer and do recovery there, recovering files to different HDD.

BTC: 18ozhbkfHneX8tnPgHJuTizyBmspM5Vgpa  LTC: LgVc7KdedPGZyDXHXEH9G7z6AoTmTvDdWb
cgminer 2.11.13 x64 portable for Mac OS X 10.6.8
6+ GPUs driver mod for Windows
lbr
Sr. Member
****
Offline Offline

Activity: 389


View Profile
April 09, 2013, 08:19:50 PM
 #4

Oh, and I use R-Studio for Mac recovery for my clients, works like a charm.

BTC: 18ozhbkfHneX8tnPgHJuTizyBmspM5Vgpa  LTC: LgVc7KdedPGZyDXHXEH9G7z6AoTmTvDdWb
cgminer 2.11.13 x64 portable for Mac OS X 10.6.8
6+ GPUs driver mod for Windows
msherwood
Newbie
*
Offline Offline

Activity: 3


View Profile
April 09, 2013, 09:29:04 PM
 #5

the console log shows a secure delete from multibit at the timestamp of his screw-up... i'm finding conflicting info about recoverability of secure deleted files. I'm now working with an image of the target HD, and am not using the actual HD to run scans. Hoping to try a better user defined signature in Boomerang to scan for multibit.wallet file and run another pass. I cant seem to find any objective comparisons for data recovery solutions, and already had boomerang. Some don't allow a user-defined file type, an a few require hexadecimal header info i'm not sure of to scan for .wallet files... so unless there is a really good reason to i'm going to stick with boomerang for now to comb through the image of the target drive. Does anyone know about DiskWarrior? It has the most robust scavenge feature for lost data i've seen, but is more useful to repair corrupted directory data. I may give it a try to scavenge for my buddy's "multibit.wallet" file. Its saved me on some crashed drives in the past to recover everything. Thanks again.
msherwood
Newbie
*
Offline Offline

Activity: 3


View Profile
December 14, 2013, 01:38:12 AM
 #6

Still haven't gotten anywhere, anyone have any ideas? Obviously this HD with 150 lost bitcoins has gone up in value since my original post.
pompiedom
Newbie
*
Offline Offline

Activity: 4


View Profile
December 14, 2013, 01:53:46 AM
 #7

Might be a stupid suggestion (but who knows Tongue), but was local backups/local snapshots (http://support.apple.com/kb/PH11394) on?
cr1776
Legendary
*
Offline Offline

Activity: 1722


View Profile
December 14, 2013, 01:59:45 AM
 #8

I presume he didn't have time machine backups on?

The rest of the advice has been good so far.
Mitchell
Staff
Legendary
*
Offline Offline

Activity: 1638


Verified awesomeness ✔


View Profile WWW
June 19, 2017, 07:07:15 AM
 #9

Locked to prevent further necro's.


▄██████████████████
███████████████████
███████████████████
█████████████████
███████████████
████████████████
████████████████
█████████████████
███████████████████
████████████████████
█████████████████████
▀████████████████████
Bazista®
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██

██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
██ █  ██ ██
██   ██  ██
██  ██   ██
██ ██  █ ██
|||
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!