Windows Critical Update- Deleted My Wallet And Keys- How To Recover?

[soniq]

Woke up this morning and computer had been restored to startup  point, wallet lost and and original key address

How to restore old wallet?

[DeathAndTaxes]

from your backup.  you have a backup right?

replace the wallet.dat in the bitcoind datadir with the backup you made.

[soniq]

dont think i did, is it possible to do a syatem restore to a previous date?

[Curium]

I'm gonna guess your wallet was stolen. Look up your address on blockexplorer and see if someone cleaned it out.

[soniq]

no , not cleaned out, is it possible to recover?

[01BTC10]

Read this : http://lifehacker.com/393084/how-to-recover-deleted-files-with-free-software

[Revalin]

Step 1.  IMMEDIATELY TURN OFF YOUR COMPUTER.  RIGHT NOW.  Don't even bother shutting it down, just unplug it.  Log back on here from another computer.

Step 2.  Get a new hard drive and make a raw dump of your whole drive.  We can help with this if you're not sure how.

Step 3.  Windows may have created a restore point before it rolled back.  If we can go back to that restore point you'll get your stuff back.

Step 4.  If that doesn't work several tools exist which can scan the raw dump and recover keys.  PyWallet is a good first choice.  We can help you with this as well, but the more you use your computer the greater the chance that the deleted files will be overwritten - that's why it's important to turn off your computer.

[soniq]

ok, computer turned off, logged on with with new computer.  I have an external drive, but it is not new, but has more than enough space . How to do a raw dump?

I have a boot drive 128G SSD C:// and a storage drive G:// 2TB HD. I am sure the bitcoin wallet was on the C://

My skype is gotgold69

[Revalin]

Perfect.  You'll need a boot CD.  You can download one here:
https://sourceforge.net/projects/systemrescuecd/files/sysresccd-x86/3.5.0/systemrescuecd-x86-3.5.0.iso/download

Burn that to a CD, then use it to boot your computer.  I'll post some more instructions in a moment.

[Revalin]

When you start it up it'll give you some options.  Just hit enter, then enter again when it asks for your keyboard settings.  After a couple minutes you'll get a command prompt.

First plug in your external storage drive.  Wait a few seconds, then type this:

Code:

fdisk -l | grep Disk

That will list all your hard drives.  You need to identify your C: drive (probably /dev/sda) and your external drive (probably /dev/sdc) - it should be obvious from the sizes but if your external drive is the same size as you D: drive you can verify it by unplugging it, hitting (up)(enter) to run the command again, and see which one appeared or disappeared.

For this example we'll say your external drive is /dev/sdc.

Next you'll need to find the partition number.  Do this:

Code:

fdisk -l /dev/sdc

It will give you a table listing /dev/sdc1 and maybe some more partition numbers - it's probably just /dev/sdc1 unless you created a bunch of partitions yourself, so I'll use /dev/sdc1 for this example.

Next you mount it (it's like giving it a drive letter):

Code:

mkdir /external
mount /dev/sdc1 /external

Finally you dump the C: drive:

Code:

pv /dev/sda > /external/dump

If that gives you an error after the first few GB are copied then do this instead:

Code:

pv /dev/sda | split -a 5 -b 1G -d /external/dump

Make sure it completes with no errors, then:

Code:

umount /external
poweroff

And you're done.

That dump will be a complete raw copy of your hard drive.  Once we have it we can start looking for your wallet without worrying about losing anything.

[Dabs]

And that is why, backups are so much easier. If you had two or 3 computers, you can set it up so that one computer copies to the other every day automatically, or manually on demand. Or if you have 2 hard drives on the same computer. Or if you even have at least another partition on the same hard drive. I usually have at least 5 partitions. My personal laptop has 10. The first partition is called: C:MAIN, and there are two partitions of identical size called DATA1 and DATA2. I use Windows.

[jackjack]

Pywallet reads the bytes of HDDs to find private key headers
I may help you to use it once the dump of your HDD is done