Bitcoin-QT Core Problem - Keypool 100 transactions limi - Reward for help: 2 BTC

[BitcoinNewsBR]

Hello, guys.

Disclaimer:
I'm working for companies related with Bitcoin since 2013, I create a new account only for no exposure my name for everybody now. I will pay the 2 BTC if we find a solution.

Problem:

Using OS/X, my HD stopped work. I tried to recover, without success. Had to format the computer. As I have my Bitcoin-QT Backup from January/2016 I was okay and didn't worried.

After formatting the computer and wait to syncronize the Bitcoin-QT it takes too long on OSX, and I had to make a transaction, and my Ledger was not with me.

First important point: I did a transaction without the wallet totally syncronized.

After it, I keep waiting the wallet syncronized. When it finished, I notice that few coins were missing.

Second important point:  After discussing on Bitcoin Core Slack channel with few friends and inclusive GMaxwell, I discovered that this transaction I generate without the full blockchain downloaded didn't return the "change" to my backup from January/2016. So, I lost the change of this transactions, because the QT backup I was using had only 100 Key pool limit (address for change address)  and as I already did more than 100 transactions from the last backup, the change is inside a address that I'm not sure if I have the private key.



Third important point: I tried to recover the wallet.dat from the date that I made the transaction, maybe the private key is there. I hired a professional recover HD company but they were not able to find the wallet.dat from between July/Sep 2016 (probably with the private key for this address)

I appreciate any help and would be happy to answer any question that maybe helps solve this problem.  Just for make sure you are not spending your time, send me a private message if you believe you can find a solution, and I will give more details about myself, so you have sure you will get paid the 2 BTC if helps recover the coins.

Thanks for your attention.

[1715430169]

1715430169

[1715430169]

1715430169

[1715430169]

1715430169

[mr.bitcoinerf11]

Hello, guys.

Disclaimer:
I'm working for companies related with Bitcoin since 2013, I create a new account only for no exposure my name for everybody now. I will pay the 2 BTC if we find a solution.

Problem:

Using OS/X, my HD stopped work. I tried to recover, without success. Had to format the computer. As I have my Bitcoin-QT Backup from January/2016 I was okay and didn't worried.

After formatting the computer and wait to syncronize the Bitcoin-QT it takes too long on OSX, and I had to make a transaction, and my Ledger was not with me.

First important point: I did a transaction without the wallet totally syncronized.

After it, I keep waiting the wallet syncronized. When it finished, I notice that few coins were missing.

Second important point:  After discussing on Bitcoin Core Slack channel with few friends and inclusive GMaxwell, I discovered that this transaction I generate without the full blockchain downloaded didn't return the "change" to my backup from January/2016. So, I lost the change of this transactions, because the QT backup I was using had only 100 Key pool limit (address for change address)  and as I already did more than 100 transactions from the last backup, the change is inside a address that I'm not sure if I have the private key.



Third important point: I tried to recover the wallet.dat from the date that I made the transaction, maybe the private key is there. I hired a professional recover HD company but they were not able to find the wallet.dat from between July/Sep 2016 (probably with the private key for this address)

I appreciate any help and would be happy to answer any question that maybe helps solve this problem.  Just for make sure you are not spending your time, send me a private message if you believe you can find a solution, and I will give more details about myself, so you have sure you will get paid the 2 BTC if helps recover the coins.

Thanks for your attention.

about the few coins you said  they will be sent to the address you sent
if you cant recover your  wallet.dat you can recover it using
http://www.recovering-deleted-files.net/recovery-software/mac-data-recovery
http://www.macworld.com/article/3101345/macs/how-to-restore-deleted-files-in-os-x.html
i will pm you now

[achow101]

Your post is a little hard to understand.

So, just to be sure, what happened was you formatted your drive, reinstalled Bitcoin Core, restored your Jan 2016 backup, and then sent Bitcoin without being synchronized.

So what did you do after that? If you still have the wallet file from when you sent the Bitcoin, the private key to the change address should still be there and you should still be able to access the Bitcoin.

[BitcoinNewsBR]

Hello, guys.

Disclaimer:
I'm working for companies related with Bitcoin since 2013, I create a new account only for no exposure my name for everybody now. I will pay the 2 BTC if we find a solution.

Problem:

Using OS/X, my HD stopped work. I tried to recover, without success. Had to format the computer. As I have my Bitcoin-QT Backup from January/2016 I was okay and didn't worried.

After formatting the computer and wait to syncronize the Bitcoin-QT it takes too long on OSX, and I had to make a transaction, and my Ledger was not with me.

First important point: I did a transaction without the wallet totally syncronized.

After it, I keep waiting the wallet syncronized. When it finished, I notice that few coins were missing.

Second important point:  After discussing on Bitcoin Core Slack channel with few friends and inclusive GMaxwell, I discovered that this transaction I generate without the full blockchain downloaded didn't return the "change" to my backup from January/2016. So, I lost the change of this transactions, because the QT backup I was using had only 100 Key pool limit (address for change address)  and as I already did more than 100 transactions from the last backup, the change is inside a address that I'm not sure if I have the private key.



Third important point: I tried to recover the wallet.dat from the date that I made the transaction, maybe the private key is there. I hired a professional recover HD company but they were not able to find the wallet.dat from between July/Sep 2016 (probably with the private key for this address)

I appreciate any help and would be happy to answer any question that maybe helps solve this problem.  Just for make sure you are not spending your time, send me a private message if you believe you can find a solution, and I will give more details about myself, so you have sure you will get paid the 2 BTC if helps recover the coins.

Thanks for your attention.

about the few coins you said  they will be sent to the address you sent
if you cant recover your  wallet.dat you can recover it using
http://www.recovering-deleted-files.net/recovery-software/mac-data-recovery
http://www.macworld.com/article/3101345/macs/how-to-restore-deleted-files-in-os-x.html
i will pm you now

Thanks for the reply.

I didn't add this on the text above, but this was the first thing I did. Even before send the HD for the recover HD service.

The problem is: The file was not "created" between July/Sep, it was created on January and then used normal. So each day, it was re-saved on the same file. So these softwares only find the files the day I created it, not the days it was auto-resaved because I was using the wallet.

Anyway, thanks for your reply!

[BitcoinNewsBR]

Your post is a little hard to understand.

So, just to be sure, what happened was you formatted your drive, reinstalled Bitcoin Core, restored your Jan 2016 backup, and then sent Bitcoin without being synchronized.

So what did you do after that? If you still have the wallet file from when you sent the Bitcoin, the private key to the change address should still be there and you should still be able to access the Bitcoin.

Sorry any misunderstanding. The situation is little hard to understand also.

1) Yes, I sent Bitcoin without the QT being syncronized.

2) I still have the file, however, the priv key is not there. I tried dumpprivkey and it don't return any result on the Bitcoin-QT console.

It is strange, how the wallet generate a public key that I do not have the priv key? It is because the address generated is not on the keypool=100 limit. So, on the January/2016 backup, the address is not there, and after the wallet had synchronized it only showed the 100 address, not the change address that have this transaction.

Thanks for your reply and your help.

[achow101]

2) I still have the file,

So right now Bitcoin Core is using the wallet.dat file you put in the data directory prior to spending? You did not touch the file at all?

however, the priv key is not there. I tried dumpprivkey and it don't return any result on the Bitcoin-QT console.

Exactly what command did you use? What is the output from the console?

[BitcoinNewsBR]

2) I still have the file,

So right now Bitcoin Core is using the wallet.dat file you put in the data directory prior to spending? You did not touch the file at all?

however, the priv key is not there. I tried dumpprivkey and it don't return any result on the Bitcoin-QT console.

Exactly what command did you use? What is the output from the console?

1) Yes. The wallet still using the January/2016 backup.

I tried to put another backups and -rescan the wallet but without success, then put again the same January/2016 file.

2) I do not remember the exact return message. But I did try it and didn't returned the expected priv key.

If you want dive in deep with me and try get this 2 BTC reward, please, send me a private message. I will also introduce me and my LinkedIn profile, so you know you are not wasting your time, and I'm a real person with good connections and will pay the 2 BTC reward for your time if I recover the coins.


Thanks for your attention, achow101.

[shorena]

-snip-
It is strange, how the wallet generate a public key that I do not have the priv key?

It cant.

It is because the address generated is not on the keypool=100 limit.

No, these are two seperate issues. Your backup might have not contained some private keys for addresses you generated recently, because you used more than 100 since the last backup. As soon as you spend coins the keypool is refilled though. The change address must have been one that was among the 100 pregenerated as of january.

So, on the January/2016 backup, the address is not there, and after the wallet had synchronized it only showed the 100 address, not the change address that have this transaction.

Thanks for your reply and your help.

Wana share a transaction ID? We sometimes have people offering ridiculous high rewards for made up problems, where the wallet did something that is not part of its code. Feel free to send it to someone you deem worthy via a PM if you want to keep private. Considering what you wrote in your first post it sounds like you are responsible for others coins as well.

[achow101]

1) Yes. The wallet still using the January/2016 backup.

I tried to put another backups and -rescan the wallet but without success, then put again the same January/2016 file.

So you put the backup file, spent, then put the backup file in there again and now you don't see the Bitcoin? Did you at any point backup the current wallet.dat file after you had spent the Bitcoin?

I think you may have lost your Bitcoin. If, after you had spent, you had replaced the wallet file already there with a backup, then you will not have the private keys to any of the addresses from your spending onwards (assuming that the keypool of the backup was actually exhausted).

2) I do not remember the exact return message. But I did try it and didn't returned the expected priv key.

Please run the command again and post both the command and its output.

[BitcoinNewsBR]

-snip-
It is strange, how the wallet generate a public key that I do not have the priv key?

It cant.

It is because the address generated is not on the keypool=100 limit.

No, these are two seperate issues. Your backup might have not contained some private keys for addresses you generated recently, because you used more than 100 since the last backup. As soon as you spend coins the keypool is refilled though. The change address must have been one that was among the 100 pregenerated as of january.

So, on the January/2016 backup, the address is not there, and after the wallet had synchronized it only showed the 100 address, not the change address that have this transaction.

Thanks for your reply and your help.

Wana share a transaction ID? We sometimes have people offering ridiculous high rewards for made up problems, where the wallet did something that is not part of its code. Feel free to send it to someone you deem worthy via a PM if you want to keep private. Considering what you wrote in your first post it sounds like you are responsible for others coins as well.

1) I spent the coins without the wallet syncronized. After the wallet finish synchronizes, the funds were not there. So, I believe the priv key is not there.

2) Here is the transactions: https://blockchain.info/pt/tx/cccfd568f5a5d6f168d335c700c0cbc07e179356f4ab8bddd3210ded2d91deb0

The transaction is this 0.08 BTC. The change is this 13 BTC.

If you believe you can help, feel free to send me a priv message so I share my identity, LinkedIn profile and Skype ID.

Thanks for your attention and your time answering this thread.

[shorena]

1) Yes. The wallet still using the January/2016 backup.

I tried to put another backups and -rescan the wallet but without success, then put again the same January/2016 file.

So you put the backup file, spent, then put the backup file in there again and now you don't see the Bitcoin? Did you at any point backup the current wallet.dat file after you had spent the Bitcoin?

I think you may have lost your Bitcoin. If, after you had spent, you had replaced the wallet file already there with a backup, then you will not have the private keys to any of the addresses from your spending onwards (assuming that the keypool of the backup was actually exhausted).
-snip-

Shouldnt the TX be unbroadcasted since the wallet wasnt synced? Nevermind, sounds like OP waited for a sync.

-snip-
1) I spent the coins without the wallet syncronized. After the wallet finish synchronizes, the funds were not there. So, I believe the priv key is not there.

Synced or not has nothing to do with how the wallet handles private keys.

2) Here is the transactions: https://blockchain.info/pt/tx/cccfd568f5a5d6f168d335c700c0cbc07e179356f4ab8bddd3210ded2d91deb0

The transaction is this 0.08 BTC. The change is this 13 BTC.

Its 3 months old.

If you believe you can help, feel free to send me a priv message so I share my identity, LinkedIn profile and Skype ID.

Thanks for your attention and your time answering this thread.

No need.

[BitcoinNewsBR]

1) Yes. The wallet still using the January/2016 backup.

I tried to put another backups and -rescan the wallet but without success, then put again the same January/2016 file.

So you put the backup file, spent, then put the backup file in there again and now you don't see the Bitcoin? Did you at any point backup the current wallet.dat file after you had spent the Bitcoin?

I think you may have lost your Bitcoin. If, after you had spent, you had replaced the wallet file already there with a backup, then you will not have the private keys to any of the addresses from your spending onwards (assuming that the keypool of the backup was actually exhausted).

2) I do not remember the exact return message. But I did try it and didn't returned the expected priv key.

Please run the command again and post both the command and its output.

1) Hd was formatted. Installed Bitcoin-qt with the January/2016 backup -> Spent -> Wait to finish the synchronized -> Notice the coins was not there -> Tried to restore other backups, coins still not there -> Restored the wallet.dat that I was using after finish syncronized. However, I'm not 100% sure if this file is the one that I did the transaction. I would say 80% sure that I have this file.

2) May you, please, tell me the commands again? Once a friend who was trying to help told it on Bitcoin-Core Slack, but now the message is not there (10,000 limit messages)

I remember that is necessary two code. The one with my wallet password to unlock the wallet and the second want is the privkeydump.

Thanks for your attention! I really appreciate it!

[shorena]

-snip-
2) May you, please, tell me the commands again?
-snip-

Code:

walletpassphrase yourpasswordhere 120

to unlock for 120 seconds

Code:

dumpprivkey 1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct

to get the private key for 1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct.

[BitcoinNewsBR]

-snip-
2) May you, please, tell me the commands again?
-snip-

Code:

walletpassphrase yourpasswordhere 120

to unlock for 120 seconds

Code:

dumpprivkey 1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct

to get the private key for 1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct.

The return of the message on the Bitcoin Core Console:

Private key for address 1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct is not known (code -4)

Proof: https://puu.sh/t0ZxE/6e005a3d9c.png

Also, not sure if this can help, here are the transactions on the Bitcoin-Core:
https://puu.sh/t0ZzM/67d3b8a63d.png

See how the transactions are at the same time. Usually the change transaction would not appear on this transactions list. So very strange! Any idea why?

Also, the transaction is showing as "Output index: 1" not sure what is this, but the other transactions appear as "Output index: 0"
Proof transaction: https://puu.sh/t0ZF8/112ee88917.png

Thanks for your time guys! I really appreciate it! Hope I can compensate it!

[szafa]

Default is generating 100 adres when 101 backup again.

[shorena]

-snip-
The return of the message on the Bitcoin Core Console:

Private key for address 1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct is not known (code -4)

Proof: https://puu.sh/t0ZxE/6e005a3d9c.png

Also, not sure if this can help, here are the transactions on the Bitcoin-Core:
https://puu.sh/t0ZzM/67d3b8a63d.png

See how the transactions are at the same time. Usually the change transaction would not appear on this transactions list. So very strange! Any idea why?

True, this is what a send to two addresses unknown to the wallet (no private key) would look like. Considering the time the transaction took place its likely that the change key was one 100+ ofter the january backup. I assume you have used the machine since you formatted it? Maybe data recovery experts can help restoring the pre format wallet file.

Also, the transaction is showing as "Output index: 1" not sure what is this, but the other transactions appear as "Output index: 0"
Proof transaction: https://puu.sh/t0ZF8/112ee88917.png

Thanks for your time guys! I really appreciate it! Hope I can compensate it!

Just that its the 1st (ID 0) or 2nd (ID 1) output of the transaction.

Default is generating 100 adres when 101 backup again.

The milk is already spilled.

[jackjack]

What did the professional recovery company look for? Old .dat files or something more specific?
Pywallet looks for headers of unique keys so keys can be recovered even from a corrupted wallet

You can try this

sudo python ./pywallet.py --recover --recov_device /dev/sda --recov_size 500Go --recov_outputdir /home/username

Replace /dev/sda with the device your wallet was on, and 500Go with the size of the disk

[BitcoinNewsBR]

What did the professional recovery company look for? Old .dat files or something more specific?
Pywallet looks for headers of unique keys so keys can be recovered even from a corrupted wallet

You can try this

sudo python ./pywallet.py --recover --recov_device /dev/sda --recov_size 500Go --recov_outputdir /home/username

Replace /dev/sda with the device your wallet was on, and 500Go with the size of the disk

The Recovery HD service tried to find a latest version of the file, so we can have there the transactions between the 100 keypool limit.

They can't find any file from between January and November, so it didn't helped.

Still no success to recover the coins.

[jackjack]

The Recovery HD service tried to find a latest version of the file, so we can have there the transactions between the 100 keypool limit.

They can't find any file from between January and November, so it didn't helped.

Still no success to recover the coins.

That's what I said, if they specifically looked for .dat files they had less chance to find the file because it may have been broken (partially rewritten)
OTOH pywallet looks for remaining keys, not for file so it may better work

"No success" is for their service or for the pywallet command I wrote?

[Borisz]

More of a question here for learning purposes

True, this is what a send to two addresses unknown to the wallet (no private key) would look like. Considering the time the transaction took place its likely that the change key was one 100+ ofter the january backup.

I am not getting how the return could go to an address about which your wallet does not know. I only see 2 options:

A: If the client knows that all keys in the old keypool have been used up (sync is recent enough), it will simply re-generate new private-public keys. This happens if you unlock the wallet to make a transaction. Hence return should go to a newly (at the time of transaction) generated address.

B: If the client does not know that all keys have been used up (sync not completed up to the point where the last address has been used), then it will send the return coins to an old address in the old keypool (say 99/100), which has already been used before (!), but for which you also ought to have the private key in the old wallet.dat. In this case the return address would have 2 transactions in it.

Please correct me if this is wrong, after all, I am here to learn.

Based on this and the transaction ID, the 13 BTC change was the only input to the return address, so I would say it is a new address generated when you sent the transaction. (Had 13 BTC been sent to a return address that was used sometime after your January backup (I do not see how that would be possible), that address would likely have another transaction in it as well. Being also old, it is quite probably that it was already used.)

BitcoinNewsBR
1. The transaction in the UI does look like if it was sent to an unknown address(mentioned by shorena), as generally return addresses are not shown in the UI. Are you perhaps using an extension/script to show these as well?
2. I think a "Private key for address X is unknown" also appears when you try to dumpprivkey with the wallet locked. I assume this is not the case.
3. Have you tried to sign a message with the return address? I saw this recommended somewhere as to double-check if you don't have the private key for an address.
4. If you haven't already, you could look at the commands listaddressgroupings and listreceivedbyaddress, they might tell you some additional info.

[shorena]

More of a question here for learning purposes

True, this is what a send to two addresses unknown to the wallet (no private key) would look like. Considering the time the transaction took place its likely that the change key was one 100+ ofter the january backup.

I am not getting how the return could go to an address about which your wallet does not know. I only see 2 options:

A: If the client knows that all keys in the old keypool have been used up (sync is recent enough), it will simply re-generate new private-public keys. This happens if you unlock the wallet to make a transaction. Hence return should go to a newly (at the time of transaction) generated address.

The client keeps track of the number of unused keys in the keypool, yes. This has little to do with syncing the blockchain, its entirely local. It requirest blockchain data to determine "used" though.

B: If the client does not know that all keys have been used up (sync not completed up to the point where the last address has been used), then it will send the return coins to an old address in the old keypool (say 99/100), which has already been used before (!), but for which you also ought to have the private key in the old wallet.dat. In this case the return address would have 2 transactions in it.

We are talking about a restoration from a backup. More below.

Please correct me if this is wrong, after all, I am here to learn.

Based on this and the transaction ID, the 13 BTC change was the only input to the return address, so I would say it is a new address generated when you sent the transaction. (Had 13 BTC been sent to a return address that was used sometime after your January backup (I do not see how that would be possible), that address would likely have another transaction in it as well. Being also old, it is quite probably that it was already used.)

BitcoinNewsBR
1. The transaction in the UI does look like if it was sent to an unknown address(mentioned by shorena), as generally return addresses are not shown in the UI. Are you perhaps using an extension/script to show these as well?
2. I think a "Private key for address X is unknown" also appears when you try to dumpprivkey with the wallet locked. I assume this is not the case.

No

Code:

dumpprivkey 1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct 
Error: Please enter the wallet passphrase with walletpassphrase first. (code -13)

3. Have you tried to sign a message with the return address? I saw this recommended somewhere as to double-check if you don't have the private key for an address.

It should not make a difference.

4. If you haven't already, you could look at the commands listaddressgroupings and listreceivedbyaddress, they might tell you some additional info.

-


What I think happend is the following.

OP created a backup in January and kept using the wallet. The wallet kept refilling the keypool whenever needed, but these are not part of the January backup. Sometime in September the 101th key since the backup in Jan was used as a change address. When the wallet was restored from backup. It recognized the transaction because it had one of the keys that controlled the input that was used. Since it did not recognize any of the output addresses it marked them as external and thus is showing them in the overview, whereas it would not show a change output.

[Borisz]

First of all, Thank you!

What I think happend is the following.

OP created a backup in January and kept using the wallet. The wallet kept refilling the keypool whenever needed, but these are not part of the January backup. Sometime in September the 101th key since the backup in Jan was used as a change address. When the wallet was restored from backup. It recognized the transaction because it had one of the keys that controlled the input that was used. Since it did not recognize any of the output addresses it marked them as external and thus is showing them in the overview, whereas it would not show a change output.

I understand, you mean the transaction was made before the computer crash (that had a return address unknown to the January backup) and the restored backup doesn't recognize the address, hence marks it as outgoing.
(Any new keys generated in the keypool after the January backup are obviously lost.)

I interpreted the post such that the transaction was made with the wallet restored  from the January backup . In this case (if the wallet has caught up with the ledger far enough to determine that all the old 100 keys have been used) the wallet would generate new addresses, right?

[BitcoinNewsBR]

Hello, guys.

I HAVE GOOD NEWS! Not so much, but it is good news.

Someone saw this thread and discussed privately with me, sending all the necessary comments for I use on the Pywallet. Thanks you so much!

I'm on OSX, we used this command on Pywallet:

Code:

sudo /Users/XXX/Downloads/pywallet-master/pywallet.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXXX/Documents/Lucky

After I run this command, it shows this:

Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys


And generate a .dat file on the folder /Users/XXXX/Documents/Lucky

So now, I need someone help:

1) I tried to open on Bitcoin-QT this .dat but didn't worked. How can I use this .dat file to see the private keys there?
2) How may I use this command again and generate a document showing the private key?
3) Usually, the keys would appear on the screen for Windows Users. For Mac, we will need to add something to the command for the output generate a txt.

Thanks for your attention!

[kolloh]

Hello, guys.

I HAVE GOOD NEWS! Not so much, but it is good news.

Someone saw this thread and discussed privately with me, sending all the necessary comments for I use on the Pywallet. Thanks you so much!

I'm on OSX, we used this command on Pywallet:

Code:

sudo /Users/XXX/Downloads/pywallet-master/pywallet.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXXX/Documents/Lucky

After I run this command, it shows this:

Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys


And generate a .dat file on the folder /Users/XXXX/Documents/Lucky

So now, I need someone help:

1) I tried to open on Bitcoin-QT this .dat but didn't worked. How can I use this .dat file to see the private keys there?
2) How may I use this command again and generate a document showing the private key?
3) Usually, the keys would appear on the screen for Windows Users. For Mac, we will need to add something to the command for the output generate a txt.

Thanks for your attention!

Assuming the .dat file isn't corrupted. You should be able to simpy open the .dat file in a texteditor or use cat to view the contents of the file. The private keys will be in this file listed under xprv . If the wallet is encrypted, you may need to unencrypt it first.

If the file looks to be corrupt, I would try the following.  Run bitcoin application with the -salvagewallet parameter via command line. This command attempts to salvage public/private keys and master encryption keys (if the wallet is encrypted) into a new wallet.dat .

[achow101]

Assuming the .dat file isn't corrupted. You should be able to simpy open the .dat file in a texteditor or use cat to view the contents of the file. The private keys will be in this file listed under xprv . If the wallet is encrypted, you may need to unencrypt it first.

This is incorrect. The wallet.dat file is not a text file, it is a binary file in the Berkeley DB format.

If the file looks to be corrupt, I would try the following.  Run bitcoin application with the -salvagewallet parameter via command line. This command attempts to salvage public/private keys and master encryption keys (if the wallet is encrypted) into a new wallet.dat .

OP, try this. Put the wallet.dat file in your data directory. Start Bitcoin Core with the -salvagewallet option. If nothing is corrupted, it will work fine. If something is corrupted, it will attempt to fix it.

[BitcoinNewsBR]

Assuming the .dat file isn't corrupted. You should be able to simpy open the .dat file in a texteditor or use cat to view the contents of the file. The private keys will be in this file listed under xprv . If the wallet is encrypted, you may need to unencrypt it first.

This is incorrect. The wallet.dat file is not a text file, it is a binary file in the Berkeley DB format.

If the file looks to be corrupt, I would try the following.  Run bitcoin application with the -salvagewallet parameter via command line. This command attempts to salvage public/private keys and master encryption keys (if the wallet is encrypted) into a new wallet.dat .

OP, try this. Put the wallet.dat file in your data directory. Start Bitcoin Core with the -salvagewallet option. If nothing is corrupted, it will work fine. If something is corrupted, it will attempt to fix it.

When I try to open the wallet using the recovered .dat as wallet.dat it shows "Wallet corrupted. Recovered failed". I don't have even the option to open the console on the Bitcoin-QT.

So I tried to open using the terminal:

I entered this:

Code:

/Applications/Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt -salvagewallet

It open the wallet and close in few seconds. Is this the command I need to enter to use this -salvagewallet option?

[achow101]

When I try to open the wallet using the recovered .dat as wallet.dat it shows "Wallet corrupted. Recovered failed". I don't have even the option to open the console on the Bitcoin-QT.

So I tried to open using the terminal:

I entered this:

Code:

/Applications/Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt -salvagewallet

It open the wallet and close in few seconds. Is this the command I need to enter to use this -salvagewallet option?

It is something like that. The -salvagewallet option is a startup option, not a debug console command. You are supposed to do something like that but I don't have a Mac so I don't know the exact way you are supposed to do it.

[kolloh]

This is incorrect. The wallet.dat file is not a text file, it is a binary file in the Berkeley DB format.

Whoops. I was looking at an Electrum wallet.dat file which likely uses a different format.

So I tried to open using the terminal:

I entered this:

Code:

/Applications/Bitcoin-Qt.app/Contents/MacOS/Bitcoin-Qt -salvagewallet

It open the wallet and close in few seconds. Is this the command I need to enter to use this -salvagewallet option?

That should be the correct method. Try checking the debug.log file which should generate some output on the results of the salvage wallet command.

[jackjack]

None of these is the correct method
The thing is that pywallet is kinda old so it creates a wallet with an old format

Please post the full log (not only the "Found X possible Y" lines) of the pywallet recovery command, I must know whether the encrypted keys were decrypted or not (with the passphrases you must have provided)

If they were not decrypted, it means that you didn't provide the correct passphrases when pywallet asked you so (ie you must run the pywallet recovery command again and provide the passphrases of your old wallets when asked)
If they were decrypted, then the recovered wallet contains all those keys and you'll be able to extract the private keys using pywallet with dumpwallet on the recovered wallet
But first things first: please provide the full log (check beforehand that there is no private data in it)

[BitcoinNewsBR]

None of these is the correct method
The thing is that pywallet is kinda old so it creates a wallet with an old format

Please post the full log (not only the "Found X possible Y" lines) of the pywallet recovery command, I must know whether the encrypted keys were decrypted or not (with the passphrases you must have provided)

If they were not decrypted, it means that you didn't provide the correct passphrases when pywallet asked you so (ie you must run the pywallet recovery command again and provide the passphrases of your old wallets when asked)
If they were decrypted, then the recovered wallet contains all those keys and you'll be able to extract the private keys using pywallet with dumpwallet on the recovered wallet
But first things first: please provide the full log (check beforehand that there is no private data in it)

Thanks for your answer jackjack. Here is the log:

I open the terminal on OSX then enter this code:

Code:

sudo /Users/XXXX/Downloads/pywallet-master/pywallet.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXXX/Documents/sorte

Return:

Code:

iMac-de-XXX:~ XXX$ sudo /Users/XXXX/Downloads/pywallet-master/pywallet.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXXX/Documents/sorte
Password:  (My System password entered)

Enter the passphrase for the wallet that will contain all the recovered keys: XXXXXX  (No doubt this is the right passphrase)

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase: XXXXXX (No doubt this is the right passphrase)
Possible passphrase:    (Enter)

Starting recovery.
0.10 Go read
0.20 Go read
0.30 Go read
0.40 Go read
0.50 Go read
0.60 Go read
0.70 Go read
0.80 Go read
0.90 Go read
1.00 Go read
1.10 Go read
1.20 Go read
1.30 Go read
1.40 Go read
1.50 Go read
1.60 Go read
1.70 Go read
1.80 Go read
1.90 Go read
2.00 Go read
2.10 Go read
2.20 Go read
2.30 Go read
2.40 Go read
2.50 Go read
2.60 Go read
2.70 Go read
2.80 Go read
2.90 Go read
3.00 Go read
3.10 Go read
3.20 Go read
3.30 Go read
.
.
.  (After 5 hours - 1Tera HD)

Read 1000.2 Go in 289.0 minutes

Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys

This is all what happened when I use this command. And then generate the .dat on the folder I set.

Any idea how I could solve this Jackjack? Thanks!

[jackjack]

Don't you have anything more?
There should be an "Importing" section at the end, after the "found X Y" lines

[BitcoinNewsBR]

Don't you have anything more?
There should be an "Importing" section at the end, after the "found X Y" lines

Nop. Don't have these lines. A User who was helping me via private message also asked about the importing key screen:

Code:

Importing key    2/1065:

But it don't show after I finish the scan. After finished the scan, that was the message I saw (previous post)

Maybe because I'm on OSX?

Thanks for your answer.

[jackjack]

Don't you have anything more?
There should be an "Importing" section at the end, after the "found X Y" lines

Nop. Don't have these lines. A User who was helping me via private message also asked about the importing key screen:

Code:

Importing key    2/1065:

But it don't show after I finish the scan. After finished the scan, that was the message I saw (previous post)

Maybe because I'm on OSX?

Thanks for your answer.

Indeed OSX may be the reason
I'll make you a custom pywallet to take care of this

[BitcoinNewsBR]

Don't you have anything more?
There should be an "Importing" section at the end, after the "found X Y" lines

Nop. Don't have these lines. A User who was helping me via private message also asked about the importing key screen:

Code:

Importing key    2/1065:

But it don't show after I finish the scan. After finished the scan, that was the message I saw (previous post)

Maybe because I'm on OSX?

Thanks for your answer.

Indeed OSX may be the reason
I'll make you a custom pywallet to take care of this

Jackjack, thanks so much! You developed a fantastic app that helps the community and keep giving support to it! I really respect this attitude.

I'm confidence that I will recover the coins and make a good donation to support the Pywallet project and also tip the ones that helped me before!

I'm posting here the wallet, so everyone know if I move the coins: https://blockchain.info/address/1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct

Thanks!

[jackjack]

Thank you for the kind words
I hope the missing pool keys are in these 5 thousands keys

The version you can try is here: https://framabin.org/?6501b12ab63d82e3#yN5vWu7fGCvx8RwGN6UpDSHpWXewPl/5NCHVyGBBfKQ=
It's basically the same with less "X Go read" lines (1 per GB, so around 3 per minute) and more verbose after the "Found X Y" lines to understand what's happening
You can check the diff (with http://diffchecker.com for exemple) between public pywallet and this one if you want

[BitcoinNewsBR]

Thank you for the kind words
I hope the missing pool keys are in these 5 thousands keys

The version you can try is here: https://framabin.org/?6501b12ab63d82e3#yN5vWu7fGCvx8RwGN6UpDSHpWXewPl/5NCHVyGBBfKQ=
It's basically the same with less "X Go read" lines (1 per GB, so around 3 per minute) and more verbose after the "Found X Y" lines to understand what's happening
You can check the diff (with http://diffchecker.com for exemple) between public pywallet and this one if you want

Hey, Jackjack.

Sorry my basically knowledge about it. But how I should proceed with it? How I execute this code? May you, please, guide me on it? Thanks

[jackjack]

Yes sorry, sure
You have to put this code in a new python file(e.g. pywalletz.py)
Then run the same recovery command, but with pywalletZ instead of pywallet

[BitcoinNewsBR]

I opened the pywalletz.py in the Xcode, deleted the code, copy and paste the new code.

Tried to run the same command again (as it is the new pywallet code on the same file now). It returns this error:

Code:

iMac-de-XX:~ XX$ sudo /Users/XXX/Downloads/pywallet-master/pywallet.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XX/Documents/sorte
  File "/Users/XXX/Downloads/pywallet-master/pywallet.py", line 22
    except:
         ^
SyntaxError: invalid syntax

Any idea what I'm doing wrong? If you can upload the file in somewhere it is also fine to me.

Thanks, jackjack.

[jackjack]

Ok then download this: https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/df64b98d2deadb577f7655d225abb8013329dd56/pywallet_BitcoinNewsBR_1.py
And run the recovery command using pywallet_BitcoinNewsBR_1.py

[BitcoinNewsBR]

Ok then download this: https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/df64b98d2deadb577f7655d225abb8013329dd56/pywallet_BitcoinNewsBR_1.py
And run the recovery command using pywallet_BitcoinNewsBR_1.py

Hey, jackjack. Thanks again for the time you spent working on the code. Here is what I got:

Code:

$ sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte
Enter the passphrase for the wallet that will contain all the recovered keys: XXX

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase: XXX
Possible passphrase: 

Starting recovery.
1.00 Go read
.
.
998.00 Go read
999.00 Go read
1000.00 Go read

Read 1000.2 Go in 317.6 minutes
Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys
a
b
c0
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4880, in <module>
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 1532, in recov
    print 'c0',tsincetz()
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 1531, in tsincetz
    return time.time()-tz
NameError: global name 'tz' is not defined

Any idea how to proceed?

Thanks for your attention!

[jackjack]

Damn I'm sorry I made a mistake, use this one: https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/93f90d6dfac629a692a38e955d7f241f2b9d815b/pywallet_BitcoinNewsBR_1.py
It's lost time but at least it doesn't write on the keys

By the way you can change the 1000Go to something smaller so that it will take less time

[BitcoinNewsBR]

Damn I'm sorry I made a mistake, use this one: https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/93f90d6dfac629a692a38e955d7f241f2b9d815b/pywallet_BitcoinNewsBR_1.py
It's lost time but at least it doesn't write on the keys

By the way you can change the 1000Go to something smaller so that it will take less time

Thanks! Scanning now... will update here soon possible!

[madmartyk]

Damn I'm sorry I made a mistake, use this one: https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/93f90d6dfac629a692a38e955d7f241f2b9d815b/pywallet_BitcoinNewsBR_1.py
It's lost time but at least it doesn't write on the keys

By the way you can change the 1000Go to something smaller so that it will take less time

I knew on the Windows version it prints the keys.  Hoping that BitcoinNewsBR can recover something!!

[BitcoinNewsBR]

Damn I'm sorry I made a mistake, use this one: https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/93f90d6dfac629a692a38e955d7f241f2b9d815b/pywallet_BitcoinNewsBR_1.py
It's lost time but at least it doesn't write on the keys

By the way you can change the 1000Go to something smaller so that it will take less time

Hey, Jackjack.

It printed information as "Looking Ckey". I'm sending you in private, as I'm not sure if this information can recover the coins. Please, take a look on the spreadsheet with the return, then let me know how to proceed. Thanks!

[jackjack]

Sorry for the delay
I see that pywallet does go in the decrypting loop (that starts with "Decrypting...")
Does it really stop after "Possible wallet #1 with passphrase #1"?
Nothing after that? Does it crash/freeze/whatever?

For future reference: end of the spreadsheet BitcoinNewsBR sent me

[BitcoinNewsBR]

Sorry for the delay
I see that pywallet does go in the decrypting loop (that starts with "Decrypting...")
Does it really stop after "Possible wallet #1 with passphrase #1"?
Nothing after that? Does it crash/freeze/whatever?

For future reference: end of the spreadsheet BitcoinNewsBR sent me
https://i.gyazo.com/2d9c36935275ff71548f4422a0a17d45.png

Nothing after that. It only shows this. It didn't crashed/freeze. The Terminal back as before I run the command, waiting another command.

Also it generate the .dat on the Folder that I selected on the command.

[jackjack]

Hmm OK I still don't know what's happening but we'll figure it out
Do you have 'pywallet_partial_recovery_*dat' files in the output dir you use?

Download the new version but don't run it yet https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/167f14db1d8b8233de7966e2f5b5cb794bc3ae0d/pywallet_BitcoinNewsBR_1.py

[BitcoinNewsBR]

Hmm OK I still don't know what's happening but we'll figure it out
Do you have 'pywallet_partial_recovery_*dat' files in the output dir you use?

Download the new version but don't run it yet https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/167f14db1d8b8233de7966e2f5b5cb794bc3ae0d/pywallet_BitcoinNewsBR_1.py

Yes. All the times I used the code it was generating a pywallet.dat on the output dir. We have like 4-5 pywallet partial recovery there.

The first time I used the code (before you update the code to OSX),  I tried to open the Bitcoin-QT with this file but it was not possible using this file dat. It says "File corrupted."

Sorry the delay to answer, I'm traveling for work, will back on the computer with the HD that we have the problem on next Thursday (19/Jan). Let me know how to proceed then!

Thanks so much for your attention on this matter, jackjack.

[jackjack]

Ok great
Then instead of

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

use this

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(with quotes if XXX has spaces)

Where LASTPYWALLETRECOVERY.dat is the last pywallet_partial_recovery_*dat you have (it shouldn't matter though as they must all be the same)
Those files contain the place where the last pywallet recovery found keys, so it just uses these instead of reading the whole disk, which means it won't take 5 hours to complete
Please confirm it works and we'll be able to solve that more easily

[BitcoinNewsBR]

Ok great
Then instead of

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /dev/rdisk0 --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

use this

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device /Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(with quotes if XXX has spaces)

Where LASTPYWALLETRECOVERY.dat is the last pywallet_partial_recovery_*dat you have (it shouldn't matter though as they must all be the same)
Those files contain the place where the last pywallet recovery found keys, so it just uses these instead of reading the whole disk, which means it won't take 5 hours to complete
Please confirm it works and we'll be able to solve that more easily

Hey, Jackjack.

Sorry the delay to answer! I was really not able to test on the right HD until today, traveling...

So, I tested scan directly on the recovered file - the one created by the last time we scanned the HD.   This is the message that I'm receiving:

Code:

Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in <module>
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 1466, in recov
    f=open(outputdir+'/pywallet_partial_recovery_%d.dat'%ts(), 'w')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat

I'm not using the last version of the pywallet code. I'm not using the one you posted on day 16, January because you told not to run this version yet.
I'm using the version you posted before it.

Looks like to scan direct the file didn't work. Should I try the newest version? Let me know how to proceed.

Thanks for your attention!! I really appreciate it and sorry for the time to answer!

[jackjack]

Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username )

[BitcoinNewsBR]

Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username )

Hey, Jackjack

Getting this error now:

Code:

Possible passphrase: 

Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in <module>
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXXDownloads/pywallet_BitcoinNewsBR_1.py", line 1472, in recov
    f=open(prf, 'r')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat'

I'm not using the last file, the one you told for I dont use. Let me know how to proceed.

Thanks!

[Decoded]

Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username )

Hey, Jackjack

Getting this error now:

Code:

Possible passphrase: 

Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in <module>
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXXDownloads/pywallet_BitcoinNewsBR_1.py", line 1472, in recov
    f=open(prf, 'r')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat'

I'm not using the last file, the one you told for I dont use. Let me know how to proceed.

Thanks!

It seems like one of you is using windows and the other Linux. Just a heads up if you haven't realised.

BitcoinNewsBR, the error you are getting signifies that it cannot find the .Bin file that you tried to reference. Re-chrck the directory and make sure that it exists.

You also didn't change the XXX.

[BitcoinNewsBR]

Damn I'm sorry I missed one bit of the command line (the green part, PartialRecoveryFile:), please do it again :

sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/LASTPYWALLETRECOVERY.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

(and don't forget to change all the XXX's to your actual username )

Hey, Jackjack

Getting this error now:

Code:

Possible passphrase: 

Starting recovery.
Traceback (most recent call last):
  File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_1.py", line 4879, in <module>
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "/Users/XXXDownloads/pywallet_BitcoinNewsBR_1.py", line 1472, in recov
    f=open(prf, 'r')
IOError: [Errno 2] No such file or directory: '/Users/XXX/Documents/sorte/pywallet_partial_recovery_1485061775.dat'

I'm not using the last file, the one you told for I dont use. Let me know how to proceed.

Thanks!

It seems like one of you is using windows and the other Linux. Just a heads up if you haven't realised.

BitcoinNewsBR, the error you are getting signifies that it cannot find the .Bin file that you tried to reference. Re-chrck the directory and make sure that it exists.

You also didn't change the XXX.

Thanks for pointing my mistake. The command was really wrong on my side, now it worked.

After run this command, it searched only on the .dat file so it worked.

It returned a really long information that I'm not sure If someone can use this to recover the coins for now, so that's the reason I'm not displaying it public here and sending to Jackjack in private.

The information looks like:

Code:

c0 XXXXXXXXXXXXXXX
c1 Looping ckey XXXXXXXXXXXXXXXXXXXX
c2 XXXXXXXXXX
c3 XXXXXXXXXX
c4 XXXXXXXXXX
c1 Looping ckey XXXXXXXXXX
c2 XXXXXXXXXX
c3 XXXXXXXXXX
c4 XXXXXXXXXX

[jackjack]

Great, you can run the exact same command but with the last version (https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/167f14db1d8b8233de7966e2f5b5cb794bc3ae0d/pywallet_BitcoinNewsBR_1.py)

[BitcoinNewsBR]

Great, you can run the exact same command but with the last version (https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/167f14db1d8b8233de7966e2f5b5cb794bc3ae0d/pywallet_BitcoinNewsBR_1.py)

Hey, guys.

For future reference, running the last code on OSX with this command:

Code:

 sudo -i /Users/XXX/Downloads/pywallet_BitcoinNewsBR_2.py --recover --recov_device PartialRecoveryFile:/Users/XXX/Documents/sorte/pywallet_partial_recovery_1484372063.dat --recov_size 1024Gio --recov_outputdir /Users/XXX/Documents/sorte

 I'm getting a return as this:

Code:

Possible passphrase:

Starting recovery.

Loaded 1000.2 Go from /dev/rdisk0

Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys
a
b
c0 XXXXX
ckey XXXXX
ckey XXXXX
ckey XXXXX
ckey XXXXX
ckey XXXXX		
d XXXXX		
Decrypting...		
Traceback (most recent call last):		
File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_2.py", line 4889, in <module>		
recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)		
File "/Users/XXX/Downloads/pywallet_BitcoinNewsBR_2.py", line 1550, in recov		
totz=len(mkeys)*len(passes)*len(list_of_possible_keys)		
UnboundLocalError: local variable 'list_of_possible_keys' referenced before assignment		

I'm sending the full information in private to Jackjack again, as I don't know if this can help I get the coins I will not make it public.


Thanks for your attention, again, JackJack.

[jackjack]

Damn I lost my code-fu I can't put 10 lines of code without an error!

OK, try with this version, it should work this time
https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/1d567003d3218e487262a4757cdebf562b725780/pywallet_BitcoinNewsBR_1.py

[BitcoinNewsBR]

Damn I lost my code-fu I can't put 10 lines of code without an error!

OK, try with this version, it should work this time
https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/1d567003d3218e487262a4757cdebf562b725780/pywallet_BitcoinNewsBR_1.py

  We will get there!

Different return now. This is final return when I execute this file:

Code:

Decrypting...
Possible wallet #1
  len(mkeys)=12
  len(passes)=1
  len(list_of_possible_keys)=241
    with passphrase #1
    DECRYPT-A

Sending the full information via private message! Thanks!

[jackjack]

OK so it runs until "DECRYPT-A" then it stops and the terminal waits for another command?
If so, I know which line is the problem but I don't get why it crashes without warning

Download this https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/afbaf88b6151d057d9fec138c340617a643d1d95/pywallet_BitcoinNewsBR_1.py
And run it without any argument, ie no "--recover" and such, I just want it to run
Then post the line that begins with "Crypter: XXX" (it should be the first line)


Also re-run the recover command (https://bitcointalk.org/index.php?topic=1728263.msg17610537#msg17610537) using each one of the 3 pywallet versions:
https://gist.githubusercontent.com/jackjack-jj/2a40a7b1101966d9a89e097e5a6c4e0b/raw/10440fd34883aeb099b19a818eb8dbeefe6b2a20/pywallet_BitcoinNewsBR_Crypter_pycrypto.py
https://gist.githubusercontent.com/jackjack-jj/d470ef536e7178ec03b4fd3a67a6cbf2/raw/cc1e52b3ccc35d8e301733a4fa3a6b2283f3ef02/pywallet_BitcoinNewsBR_Crypter_ssl.py
https://gist.githubusercontent.com/jackjack-jj/ea706e1c06f1d98f51a6be4ac86953c4/raw/9f342e0de8ee4329ebac1a743010fc595c526271/pywallet_BitcoinNewsBR_Crypter_pure.py

At least one of them should not crash

[BitcoinNewsBR]

OK so it runs until "DECRYPT-A" then it stops and the terminal waits for another command?
If so, I know which line is the problem but I don't get why it crashes without warning

Download this https://gist.githubusercontent.com/jackjack-jj/d3a9b74cef28d2f79ab113d8f3b96a82/raw/afbaf88b6151d057d9fec138c340617a643d1d95/pywallet_BitcoinNewsBR_1.py
And run it without any argument, ie no "--recover" and such, I just want it to run
Then post the line that begins with "Crypter: XXX" (it should be the first line)


Also re-run the recover command (https://bitcointalk.org/index.php?topic=1728263.msg17610537#msg17610537) using each one of the 3 pywallet versions:
https://gist.githubusercontent.com/jackjack-jj/2a40a7b1101966d9a89e097e5a6c4e0b/raw/10440fd34883aeb099b19a818eb8dbeefe6b2a20/pywallet_BitcoinNewsBR_Crypter_pycrypto.py
https://gist.githubusercontent.com/jackjack-jj/d470ef536e7178ec03b4fd3a67a6cbf2/raw/cc1e52b3ccc35d8e301733a4fa3a6b2283f3ef02/pywallet_BitcoinNewsBR_Crypter_ssl.py
https://gist.githubusercontent.com/jackjack-jj/ea706e1c06f1d98f51a6be4ac86953c4/raw/9f342e0de8ee4329ebac1a743010fc595c526271/pywallet_BitcoinNewsBR_Crypter_pure.py

At least one of them should not crash

Using the version pywallet_BitcoinNewsBR_Crypter_pure.py worked really well! Thanks!

Code:

Using pywallet_BitcoinNewsBR_Crypter_pure.py found 965 but and it shows the right information:

[code]Importing key  965/965:
Address (Bitcoin): XXX
Privkey (Bitcoin): XXX
Hexprivkey: XXX
Hash160: XXX
Pubkey: XXX
Address (Bitcoin): XXX
Privkey (Bitcoin): XXX
Hexprivkey: XXX
Hash160: XXX
Pubkey: XXX

But it didn't find the information I was looking for . The wallet https://blockchain.info/pt/address/1HxeCXGT11wVwy78gsVrzFfkfdijQE9rct is not there.

When I run the command it says:

Code:

Found 12 possible wallets
Found 5862 possible encrypted keys
Found 0 possible unencrypted keys

5862 would be the amount of address? If I didn't find the public address using this method, no other way I could get it?

It also says:

Code:

Private keys not decrypted: 13
Trying all the remaining possibilities (156) might take up to 0 minutes.
Do you want to test them? (y/n): y

Private keys not decrypted: 13
Try another password, check the size of your partition or seek help
The wallet is encrypted and the passphrase is correct

What would be this 13 private keys not decrypted?

Thanks for your attention, Jackjack.[/code]

[HI-TEC99]

If I didn't find the public address using this method, no other way I could get it?

You could try using a hex editor to do a sector-by-sector search of your hard drive for these bytes

01 03 6B 65 79 41 04

For each occurrence of those bytes you can find there is probably a Bitcoin private key nearby.

This is a hex editor with a suitable search function for a Mac. Its sourceforge files also include Windows and Linux versions.

https://sourceforge.net/projects/wxhexeditor/files/wxHexEditor/v0.23%20Beta/wxHexEditor-v0.23-MacIntel.dmg/download

This quote gives more detailed instructions, and the thread it's from might be worth reading.

I have been doing some tinkering around, thinking about other people's wallet disasters, and believe I have come to the following conclusion...

If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer.  If so, recovery is no longer purely theoretical.  With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable.

So here goes...

If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence:

01 03 6B 65 79 41 04...........

the middle four of these bytes represent the string "keyA" in ASCII.

Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later.  The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s).

Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex).  These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes).  If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins!  Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find.  Carefully search the sectors adjacent to any sector containing the "keyA" sequence above.  Then yell for help!  (But don't share the private keys in public, unless you want to give away your wallet.)

An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex.  In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan.  Scanning a full disk can take hours.  WinHex must "run as administrator" to be able to scan a physical disk.  Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible.  Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary.

[jackjack]

Yes 5862 is the total number of addresses found in the HDD
I think you won't be able to find anything more than these 5862 keys because pywallet uses a loose criterium to find keys
It drops to 965 ("Importing key 965/965") because there are duplicates, maybe you made copies of your wallets
The 13 remaining keys are either from a wallet with a different passphrase (only 13 keys is really odd though), corrupted keys because of rewriting, or not keys at all (false positives)

If you are 100% sure your address isn't in the recovered wallet I think there's not much left to try :-(
You can try the software above but pywallet does the same thing
One last question, does the recovered wallet contains the paying address, 1NJm35r6oFU3ttoUoZnqZ1nnwCH3DEbdVz?

[gloriabtc]

I knew on the Windows version it prints the keys.  Hoping that BitcoinNewsBR can recover something!!