Bitcoin Forum
June 17, 2019, 10:22:07 AM *
News: Latest Bitcoin Core release: 0.18.0 [Torrent] (New!)
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Corrupt wallet.dat file. NEED HELP  (Read 1017 times)
Sammo619
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
March 17, 2017, 05:35:03 PM
 #1

Hello, I'm New to this so apologies if I've posted in the wrong section etc.
I've had the nightmare scenario of loosing all my backups and then discovering the one trace left if an overwritten file on the original hard drive.
The freely available undelete software can locate this file but cannot recover it, and specialist companies don't really sound too enthusiastic that they can help either but will take a look.

I've searched and searched and have found the stuff on pywallet.py but I'm not great at coding and I'd basically say I'm a noon, electrical engineering is my field.

The wallet was made on Bitcoin QT core in 2014 and I'm not sure if I had a paraphrase or not but I'm sure I could cover any possibilities of what it probably is.
I've got hex editor and all the tools needed but I have no idea how to use them.
The system is on windows 10 with the hard drive in question now mounted so it's not the root drive.

Any help on this would be ace, but I'm aware it's already maybe too late Sad
1560766927
Hero Member
*
Offline Offline

Posts: 1560766927

View Profile Personal Message (Offline)

Ignore
1560766927
Reply with quote  #2

1560766927
Report to moderator
1560766927
Hero Member
*
Offline Offline

Posts: 1560766927

View Profile Personal Message (Offline)

Ignore
1560766927
Reply with quote  #2

1560766927
Report to moderator
1560766927
Hero Member
*
Offline Offline

Posts: 1560766927

View Profile Personal Message (Offline)

Ignore
1560766927
Reply with quote  #2

1560766927
Report to moderator
There are several different types of Bitcoin clients. Hybrid server-assisted clients like Electrum get a lot of their network information from centralized servers, but they also check the server's results using blockchain header data. This is perhaps somewhat more secure than either server-assisted clients or header-only clients.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1560766927
Hero Member
*
Offline Offline

Posts: 1560766927

View Profile Personal Message (Offline)

Ignore
1560766927
Reply with quote  #2

1560766927
Report to moderator
1560766927
Hero Member
*
Offline Offline

Posts: 1560766927

View Profile Personal Message (Offline)

Ignore
1560766927
Reply with quote  #2

1560766927
Report to moderator
HI-TEC99
Legendary
*
Offline Offline

Activity: 1582
Merit: 1070



View Profile
March 17, 2017, 05:54:27 PM
Last edit: March 31, 2017, 10:35:54 AM by HI-TEC99
 #2

Using a hex editor to search is explained here.



You could try using a hex editor to do a sector-by-sector search of your hard drive for these bytes

01 03 6B 65 79 41 04

For each occurrence of those bytes you can find there is probably a Bitcoin private key nearby.

This is a hex editor with a suitable search function for a Mac. Its sourceforge files also include Windows and Linux versions.

https://sourceforge.net/projects/wxhexeditor/files/wxHexEditor/v0.23%20Beta/wxHexEditor-v0.23-MacIntel.dmg/download

This quote gives more detailed instructions, and the thread it's from might be worth reading.

I have been doing some tinkering around, thinking about other people's wallet disasters, and believe I have come to the following conclusion...

If you have lost your wallet.dat for whatever reason (deleted it, formatted your drive, file corruption, etc.) it's possible that it may still be lurking on your computer.  If so, recovery is no longer purely theoretical.  With a little knowledge of what to search for, you can use a hex editor to potentially find usable remnants of your wallet.dat file and get back your bitcoins, even if the original file isn't fully recoverable.

So here goes...

If you can use a hex-editor to do a sector-by-sector search/edit on your entire hard drive, then search your entire hard drive for occurrences of the following byte sequence:

01 03 6B 65 79 41 04...........

the middle four of these bytes represent the string "keyA" in ASCII.

Each time this byte sequence occurs, a Bitcoin private key is probably stored nearby, about 180 bytes later.  The 32-byte private key is the only thing you need to recover your bitcoins!... as long as you find the right one(s).

Approximately 180 bytes after this sequence, you may find the byte sequence 04 20 (hex).  These two bytes seem to precede every private key (the 0x20 suggests a length of 32 bytes).  If you find this sequence, the thirty-two bytes that come after 04 20 are the private key representing a Bitcoin address and might be the private key that recovers some of your lost bitcoins!  Your wallet will have numerous private keys (at least one hundred, due to the pre-allocation of keys)... get as many as you can find.  Carefully search the sectors adjacent to any sector containing the "keyA" sequence above.  Then yell for help!  (But don't share the private keys in public, unless you want to give away your wallet.)

An example of a hex editor that can scan an entire disk volume for specific byte sequences for Windows is WinHex.  In WinHex, use Tools, Open Disk (F9), and choose the disk you want to scan.  Scanning a full disk can take hours.  WinHex must "run as administrator" to be able to scan a physical disk.  Someone please recommend a good way to do this in Linux, preferably with a known Live CD, if possible.  Also, any time you are scanning a disk for potentially lost data, you should NEVER boot the disk you're searching - always boot from another disk and install the target disk as secondary.

Sammo619
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
March 17, 2017, 06:26:55 PM
 #3

I'm working through this page just now.....

https://bitcointalk.org/index.php?topic=34028.520
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!