Searching old HD's

[Malawi]

I have dabbled slightly with BTC before, I remember that I dl'ed the blockchain and did some mining. Not sure if I got anything before I decided that it was not worth the hassle.

Anyways, I have a small stack of old HD's that I'm thinking of going trough, looking for a wallet. They may either be deleted or formated - most likely the latter.
I am looking for some freeware that I can use to go trough these disks with, does anyone have suggestions?

[alxs]

"F3" in windows ?

[01BTC10]

This might help: http://en.wikipedia.org/wiki/List_of_digital_forensics_tools

[philips]

Testdisk & Photorec: http://www.cgsecurity.org

[deepceleron]

The correct tool to use is pywallet, it can scan the whole hard drive raw and extract any private keys it finds. There is a thread describing how to do this.

[Malawi]

Testdisk looks promising, the forensic tools are also interesting.

Gotta look into pywallet - sounds very promising.


But want to clarify that It's not a problem finding the file itself when they are visible to the OS.
BTW: My guess is that the quickest way to find an intact wallet is to just use something like "dir \wallet.* /s" or "dir \?allet.* /s" after undeleting.

[kodo]

Testdisk & Photorec: http://www.cgsecurity.org

Yes this might work good.

[Abdussamad]

A real bitcoin treasure hunt!

[jackjack]

Testdisk looks promising, the forensic tools are also interesting.

Gotta look into pywallet - sounds very promising.


But want to clarify that It's not a problem finding the file itself when they are visible to the OS.
BTW: My guess is that the quickest way to find an intact wallet is to just use something like "dir \wallet.* /s" or "dir \?allet.* /s" after undeleting.

Yep, pywallet will search private keys on the HDD.
It doesn't search for a filename though as the file may have been partially rewritten. It looks for private key headers that you can find in a wallet.
It'd be easier to use on Linux as AFAIK nobody tried the key recovery function on Windows.

You can also use wxHexEditor (all platforms) that will basically do the same thing but it is specifically designed to search a set of bytes. It's less blackbox than pywallet.