2.9 BTC possibly lost

[mr.mister]

A close friend has formatted his hard drive with the Ultimate Boot CD prior to installing his new operating system. In the process, among other things, he forgot to back up his wallet, and his seed was in a text file that he never copied to paper, as he should have. I gave him hell about this. The wallet was the electrum wallet, same one I use. The only thing he had written down, are his send to and receive addresses? I told him that, without the wallet seed, or him having backed up the wallet keys, there is nothing he can do, and that the BTC may be locked forever. Am I correct to say that? Can someone think of something he can do? Should he bring his computer to a forensics expert at this point? Any help would be appreciated.


Thank-You in advance.

[Rexxxem]

Depends on the operating system. For windows whenever you upgrade, or reinstall an operating system, there should be a folder called "windows.old". It is pretty much all data you had before reinstallation. Not sure if it works for all versions or if you need to check hidden folders.

There is also a program called "recuva". It can retrieve files from re-written, corrupt, or damaged discs.. I've personally never used it but have heard plenty about it.

Hope this helps or a better solution is recommended. I know that has to be a terrible feeling. Good luck to your friend and tell them to be more thorough from now on!

[HI-TEC99]

The built in windows formatter has a checkbox labelled "quick format". If that's checked when you format then it's possible to use data recovery software like recuva to recover files. If it's not checked formatting takes longer, but is very likely to destroy all the files.

What application from the Ultimate Boot CD did your friend format his hard drive with? If it had a "quick format" option, and he used it, then his files might be recoverable.

There's other data recovery software available besides recuva. You can find a list of more here.

http://www.snapfiles.com/freeware/system/fwdatarecovery.html

[mr.mister]

Depends on the operating system. For windows whenever you upgrade, or reinstall an operating system, there should be a folder called "windows.old". It is pretty much all data you had before reinstallation. Not sure if it works for all versions or if you need to check hidden folders.

There is also a program called "recuva". It can retrieve files from re-written, corrupt, or damaged discs.. I've personally never used it but have heard plenty about it.

Hope this helps or a better solution is recommended. I know that has to be a terrible feeling. Good luck to your friend and tell them to be more thorough from now on!

Thank-you for the reply. I will relay the information to him immediately, and if anyone else has anything to add, it would be greatly appreciated.  The management of his wallet was very poor. He understands that now, that he is facing the possible reality of being out about 3k.

[cpfreeplz]

The ultimate boot Cd has what like 100 different applications? Which one did he use? Assuming he didn't overwrite everything with zeros (if it took a few hours then he probably did this) you're probably screwed but like a previous answer said if it was a quick format the information is technically still there until it's written over. It's a bad analogy but it's kind of like recording over a tape. The original is still there until you write over it.

[mr.mister]

The ultimate boot Cd has what like 100 different applications? Which one did he use? Assuming he didn't overwrite everything with zeros (if it took a few hours then he probably did this) you're probably screwed but like a previous answer said if it was a quick format the information is technically still there until it's written over. It's a bad analogy but it's kind of like recording over a tape. The original is still there until you write over it.

I just asked. He used one called DBAN, and he said he overwrote over the whole hard drive, it took like 3 hours he said.

[kolloh]

He should immediately stop using the hard drive if he wants any chance at recovering the files.

Then you can try to use some undelete software such as TestDisk ( http://www.cgsecurity.org/wiki/TestDisk ), PhotoRec ( http://www.cgsecurity.org/wiki/PhotoRec ) (with a custom signature for the electrum wallet file ) or similar utilities and you may be able to recover the wallet files.

Edit: If he used DBAN ( https://en.wikipedia.org/wiki/Darik%27s_Boot_and_Nuke ), then it is unlikely he'll be able to recover any files using the above methods.

[HI-TEC99]

The ultimate boot Cd has what like 100 different applications? Which one did he use? Assuming he didn't overwrite everything with zeros (if it took a few hours then he probably did this) you're probably screwed but like a previous answer said if it was a quick format the information is technically still there until it's written over. It's a bad analogy but it's kind of like recording over a tape. The original is still there until you write over it.

I just asked. He used one called DBAN, and he said he overwrote over the whole hard drive, it took like 3 hours he said.

What dban wipe method did he use to overwrite his data? Even the quick erase wipe method that overwrites with zeros  probably destroyed his files. If he used any other wipe method it overwrote with random data and definitely destroyed his files.

Dban is a hard drive scrubber, it's designed to irretrievably scrub all data from a hard drive. Your friends files are almost certainly lost.

This site explains how it works.

https://dban.org/

These are some screenshots of it. If he used anything else but quick erase his files are gone, and even if he used quick erase they are probably gone. If he used quick erase then tell him to google for "data recovery" and find a company like the one linked below. They have specialist equipment to recover files, but their services aren't cheap, and even if he used quick erase I would be surprised if they can recover anything.

http://www.datarecovery.net/hard-drive-recovery.aspx

[Abdussamad]

Should he bring his computer to a forensics expert at this point? Any help would be appreciated.

This ^^. He shouldn't risk using that drive any more. Certainly don't attempt data recovery yourself.

[mr.mister]

Yes, he's stop using the drive to decide what the best option may be. As far as the erase method he used, he remembers setting it to 'wipe' the drive. He said he set it to the least number of passes. 

I am not sure if there is much hope, If he cannot recover these coins. Do they just remain locked in the blockchain forever?

[HI-TEC99]

Yes, he's stop using the drive to decide what the best option may be. As far as the erase method he used, he remembers setting it to 'wipe' the drive. He said he set it to the least number of passes.  
.
I am not sure if there is much hope, If he cannot recover these coins. Do they just remain locked in the blockchain forever?

Yes, they will stay in the same address forever. He will still be able to see them in his address on a block explorer, but he'll never be able to move them again.

If he set dban to do the least number of passes it probably overwrote his data with zeros. His files are probably unrecoverable, but it might be worth him asking a data recovery company for their opinion. Overwriting with zeros is the least aggressive scrubbing method dban uses.

[cpfreeplz]

Yes, he's stop using the drive to decide what the best option may be. As far as the erase method he used, he remembers setting it to 'wipe' the drive. He said he set it to the least number of passes.  
.
I am not sure if there is much hope, If he cannot recover these coins. Do they just remain locked in the blockchain forever?

Yes, they will stay in the same address forever. He will still be able to see them in his address on a block explorer, but he'll never be able to move them again.

If he set dban to do the least number of passes it probably overwrote his data with zeros. His files are probably unrecoverable, but it might be worth him asking a data recovery company for their opinion. Overwriting with zeros is the least aggressive scrubbing method dban uses.

Exactly. It can't hurt to ask. The problem is the price to even look into this is probably going to be a lot of money with no guarantees. Get a few different opinions and a few different quotes.

I wish your friend good luck. Never say never!

[kolloh]

The problem is the price to even look into this is probably going to be a lot of money with no guarantees. Get a few different opinions and a few different quotes.

Yeah, these recovery services do tend to be quite expensive which will likely eat into the 2.9BTC on the original wallet. Without a guarantee, I'm not sure I would personally pay for such a service unless you only need to pay if they can recover the data.

[Abdussamad]

Yes, he's stop using the drive to decide what the best option may be. As far as the erase method he used, he remembers setting it to 'wipe' the drive. He said he set it to the least number of passes. 

Oh this is not looking good. I just saw the post by Hi-Tec99. If your friend used a secure erase software then there is nothing that can be done.

I am not sure if there is much hope, If he cannot recover these coins. Do they just remain locked in the blockchain forever?

Yep they are inaccessible forever and what happens is that everyone else's coins become more valuable for it.

You asked about the cost of professional data recovery. There was an AMA on reddit from a guy in that business and he said prices start at $300. If your friend hadn't gone overboard and used the secure wipe software it would have been a viable option. But he did so it isn't I'm afraid.

[mr.mister]

Well, the hard drive has been removed and it's in the hands of someone who knows how to use data recovery software, however, it's already been explained to him, that the recovery will be unlikely.  So there goes about $3k or more just trapped in the block chain forever.

Right now he has set up a watch only wallet, since he had the addresses, but that will do him no good.