Bitcoin private key/wallet.dat data recovery tool!

[hmongotaku]

windows version?

[1685920467]

1685920467

[1685920467]

1685920467

[1685920467]

1685920467

[1685920467]

1685920467

[1685920467]

1685920467

[1685920467]

1685920467

[makomk]

Finally got around to adding the compressed public key support required to recover wallets created by Bitcoin 0.6 and up.

windows version?

Afraid not, sorry.

[sadpandatech]

Does it matter what file system is on the HDD that we are attempting to recover from?

[makomk]

Does it matter what file system is on the HDD that we are attempting to recover from?

Not particularly, so long as it's not encrypted or compressed. Some filesystems may give a better chance of success than others though.

[NRF]

Edit: Updated to create a new wallet.dat with the recovered keys.
Edit 2: New v0.2 release, new instructions. Note that this still can't recover encrypted wallets!
Edit 3: v0.3 release to support the compressed public keys created by recent Bitcoin versions. Still can't recover encrypted wallets.

Sorry for doing a necro, but this is a great little bit of code!  Sucks the private keys directly out of a drive, does not care about file system, OS's or anything!  I just had to sub to it.

I have already put it onto my Recovery USB and tested several different scenarios.  Any ideas on how/when you are going to implement support for encrypted wallets?  I think that encrypted wallets is the last thing left and then this will be the ultimate key recovery tool.

Thanks

[nikolaicheg]

Hello! any chance to get this tool working with crypted wallets?

[eXcelleNt]

I tried this, but it isn't working for me.

I downloaded SystemRescueCd  ---> http://www.sysresccd.org/SystemRescueCd
I booted from a DVD and went straight to the GUI, had terminal open, typed in exactly what is written in the OP and I get an error in terminal.

After I type the part with "sudo ....."
Terminal responds with:

zsh: correct 'sudo' to '_sudo' [nyae]?

If I press y: _arguments:comparguments:312:can only be called from completion function
If I press n: zsh: command not found : sudo

I have 4 hard-drives and 1 SSD. I disconnected all of them and connected the 1 hard-drive that I need to run the recovery tool on (this HDD is not bootable). It's not connected to the number 1 SATA port on the mobo. Does this therefore affect the part of the code with:  '/dev/sda'? Or what's going on?

[Manstef]

Hi makomk,

Is this a linux version?

I have a corruption with Litecoin but dont know if there's even a problem with the wallet...

Just have the error:
"A fatal error occured. Litecoin can no longer continue safely and will quit.
EXCEPTION: 11DbException       
Db::open: Invalid argument       
litecoin in Runaway exception "

Can I try loading the wallet in a fresh install of the client does anybody know?

Cheers

[whpulsar85]

Would love more info and a Windows version here...

[tlhonmey]

Yes, this is a Linux version.  You'll want to stop using the OS that's on the drive with the corrupted wallet as soon as possible to reduce the odds of lost data being over-written and destroyed.  The easiest way to do that is with a Linux live CD, so don't hold your breath for a Windows version, I doubt it's really worth the time.  (Although the program would probably compile and run under cygwin or mingw just fine.)


You should be able to erase the block chain files or copy the wallet to a fresh install to see if it's really the wallet that's damaged.  I recommend using a different machine if possible just in case.

[cnsunshu]

I was trying to recover my corrupted bitcoin wallet with your recovery tool, I used a Ubuntu 13.04 install CD, I managed to extract 101 key pairs, and I can find the recovered-wallet.dat file, however I couldn't move the file to anywhere, it says "Error opening file: Permission denied", I've got root by type in "su" command in teminal but still no help. I'm not familiar with Linux system so could you please help me with this issue? Thanks

[Praxis]

Would it be possible to retrieve other *coins? namecoin, devcoin, litecoin etc. wallets?

[Kinetic915]

Bump here.

So any news on recovering encrypted wallets? 

[skyrater]

I have a slightly different scenario and would need help.

A mate's pc crashed (it was on Windows 7), the file system (NTFS) is half corrupt, so the HDD itself won't boot or be recognised by other PC. I extracted the HDD and connected to a working PC with a USB-SATA cable.
With a data recovery tool I reconstructed the file system and tried to recover the critical wallet.dat file. I can get the entire dir out but wallet.dat seem corrupt (the file opened in an HEX file shows all zeros, seem totally empty).
How would I run this tool to scan the crashed HDD in search of these key traces?

[Martijnvdc]

I have a slightly different scenario and would need help.

A mate's pc crashed (it was on Windows 7), the file system (NTFS) is half corrupt, so the HDD itself won't boot or be recognised by other PC. I extracted the HDD and connected to a working PC with a USB-SATA cable.
With a data recovery tool I reconstructed the file system and tried to recover the critical wallet.dat file. I can get the entire dir out but wallet.dat seem corrupt (the file opened in an HEX file shows all zeros, seem totally empty).
How would I run this tool to scan the crashed HDD in search of these key traces?

By putting a linux distro on a CD/flash drive, then boot it and run the tool.

[skyrater]

I have a slightly different scenario and would need help.

A mate's pc crashed (it was on Windows 7), the file system (NTFS) is half corrupt, so the HDD itself won't boot or be recognised by other PC. I extracted the HDD and connected to a working PC with a USB-SATA cable.
With a data recovery tool I reconstructed the file system and tried to recover the critical wallet.dat file. I can get the entire dir out but wallet.dat seem corrupt (the file opened in an HEX file shows all zeros, seem totally empty).
How would I run this tool to scan the crashed HDD in search of these key traces?

By putting a linux distro on a CD/flash drive, then boot it and run the tool.

The hard disk crashed is now an extranl drive of a working PC with Windows XP.
It is NOT recognised by the OS, so probably alsso linux will not be able to see it properly.

Only data recovery tools (like ZAR which I used) can reconstruct the File system on the crashed hdd by reading data in fragments and recovering them. I was wondering if this wallet recovery tool can do something similar or needs a drive mapping (which cannot be done due to the crash) to start with...

Also: can anyone recommend any small linux distribution which can fit on a USB drive and work with this tool?
I don't have a cd reader on that PC.

[Martijnvdc]

I have a slightly different scenario and would need help.

A mate's pc crashed (it was on Windows 7), the file system (NTFS) is half corrupt, so the HDD itself won't boot or be recognised by other PC. I extracted the HDD and connected to a working PC with a USB-SATA cable.
With a data recovery tool I reconstructed the file system and tried to recover the critical wallet.dat file. I can get the entire dir out but wallet.dat seem corrupt (the file opened in an HEX file shows all zeros, seem totally empty).
How would I run this tool to scan the crashed HDD in search of these key traces?

By putting a linux distro on a CD/flash drive, then boot it and run the tool.

The hard disk crashed is now an extranl drive of a working PC with Windows XP.
It is NOT recognised by the OS, so probably alsso linux will not be able to see it properly.

Only data recovery tools (like ZAR which I used) can reconstruct the File system on the crashed hdd by reading data in fragments and recovering them. I was wondering if this wallet recovery tool can do something similar or needs a drive mapping (which cannot be done due to the crash) to start with...

Also: can anyone recommend any small linux distribution which can fit on a USB drive and work with this tool?
I don't have a cd reader on that PC.

This tool ignores whatever filesystem there is. It just reads it raw. It reads it as if the whole disk is just one big file. You don't need the disk to be mountable.
You can use System Rescue CD, it comes with all the tools you'll need.

Feel free to email me or PM me; i can help you through.

[skyrater]

I tried this, but it isn't working for me.

I downloaded SystemRescueCd  ---> http://www.sysresccd.org/SystemRescueCd
I booted from a DVD and went straight to the GUI, had terminal open, typed in exactly what is written in the OP and I get an error in terminal.

After I type the part with "sudo ....."
Terminal responds with:

zsh: correct 'sudo' to '_sudo' [nyae]?

If I press y: _arguments:comparguments:312:can only be called from completion function
If I press n: zsh: command not found : sudo

I have 4 hard-drives and 1 SSD. I disconnected all of them and connected the 1 hard-drive that I need to run the recovery tool on (this HDD is not bootable). It's not connected to the number 1 SATA port on the mobo. Does this therefore affect the part of the code with:  '/dev/sda'? Or what's going on?

I can help you here, as I had the exact same problem.
It is a problem due to how gentoo (the base of SystemRescueCd) works.
You solve it doing this.

Instead of typing sudo ./wallet-recover-0.3-linux/bin/32/wallet-recover /dev/sda recovered-wallet.dat
in the terminal window you type first:
su
(so you get the superuser priviledges)
and then simply:
./wallet-recover-0.3-linux/bin/32/wallet-recover /dev/sda recovered-wallet.dat

It will then work.

Also, careful if you work with external devices your drive to scan will NOT be sda.
with the crashed hard disk connected via usb in my case was sdc
You can see a list of all your drives via the system menu - partition names

[skyrater]

This tool ignores whatever filesystem there is. It just reads it raw. It reads it as if the whole disk is just one big file. You don't need the disk to be mountable.
You can use System Rescue CD, it comes with all the tools you'll need.

Feel free to email me or PM me; i can help you through.

Thank you for the suggestions.
I was able to set it up to make it start but:
a) The key scan is taking very long. After an hour or so the program stops with 'io error: impossible to read' or something like that.
Of course the hd is crashed, so there might be some damaged clusters. Is there any way to make the program continue anyway instead of stopping?

b) The program seem to find a large number of keys. On the first scan it found 302 keys after 2 hours of work (but there was a power cut, so I could not even see the result file...). On successive scans around 100 keys. On the terminal screen I see a new line for each new key with a private key output. Is this useful in any way?

c) The file recovered-wallet.dat is written at each new key or only at the end?
I ask as I was not able to have a full run (due to the power cut and the reading errors in the next runs), but in two cases I saved the file recovered-wallet.dat. This does not seem to be populated at all. Certainly looking at it with an hex editor I cannot see any sign of the 100 keys the program tells me being recovered. Maybe they were not written yet?
Any suggestion how to make use of the terminal dump with all those private keys to attempt seeing if any of those is the lost wallet key I am after?

[scutzi128]

will this prgram work for a litecoin wallet instead of a bitcoin wallet?