[Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive

[Praxis]

1) I had a Linux system with many wallets ,bitcoin, litecoin, devcoin, etc.  and due to immense stupidity forgot to backup the hidden dot.folders ( .litecoin , .namecoin ... ) - where the wallets are - upon reinstalling a new OS

2) After deleting the partition and just before starting installing a new OS I cancelled this so the disk is still empty - no files were written over it ... this is why I have hope

3) I tried this tool: http://www.btcnn.com/2011/09/recovering-lost-due-to-format-bitcoin.html -

it did recover around 555 keys ... but it saves them all in one .dat - how can I ever import them unto many wallets?

4) I tried using PhotoRec to recover the .dat files using this : http://www.cyplo.net/2012/04/01/bitcoin-wallet-recovery-photorec/ - guide

this looks better since it saves many .dat files ... but some are 180 KB, some are 300 KB, some are 1 MB, some 600 MB (?)

I tried running *coin in a LiveCD environment and replacing wallet.dat with each of those files but it doesnt work.

---

I'm about to give up ... any ideas? I'll reward the person who can help

[jackjack]

Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet.
If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes.

[Praxis]

Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet.
If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes.

Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it.

It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk )

So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins

[jackjack]

Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet.
If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes.

Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it.

It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk )

So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins

Pywallet does read raw disks, look in the help for the 4 commands starting with --recov. See http://pywallet.tk/ too, "Read a device to find deleted keys (CLI only)".
It definitely works on Linux, I tested it myself.

Also, as it looks for private keys, all your private keys are put in the recovered wallet. Bitcoin, Litecoin or whatever.

[Praxis]

Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet.
If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes.

Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it.

It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk )

So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins

Pywallet does read raw disks, look in the help for the 4 commands starting with --recov. See http://pywallet.tk/ too, "Read a device to find deleted keys (CLI only)".
It definitely works on Linux, I tested it myself.
 
Also, as it looks for private keys, all your private keys are put in the recovered wallet. Bitcoin, Litecoin or whatever.

This is amazing, thank you. Are you the creator of this tool? It's a life safer.
I'm doing the raw recovery now & it will take some time.
 Excuse the (probably) dumb question, but what is "Gio"?
Is it the same as gigabytes?  1 Gio = 1 GB ?

[Praxis]

It managed to import just a few keys (2 or 3) and then gave me this error:

Traceback (most recent call last):
  File "./pywallet.py", line 4438, in <module>
    importprivkey(db, sec, "recovered: %s"%sec, None, True)
  File "./pywallet.py", line 2291, in importprivkey
    crypted = 'salt' in json_db['mkey']
KeyError: 'mkey'
xubuntu@xubuntu:~$

[jackjack]

Pywallet can read all the private keys it can find (doesn't care if in a .dat or not) on a partition and put them all in the same wallet.
If for whatever reason you don't want to use it, give a look at wxHexEditor. It might allow to search for patterns (prefix of private keys for example) and save the following bytes.

Thanks. Pywallet looks great, the problem is, I deleted the partition on which the files were. So I need a "raw scan" or "deep scan" or how should I put it.

It does work however if I apply Pywallet ON the recovered .dat (recovered with the makomk tool : https://bitcointalk.org/index.php?topic=25091.0 - it scans whole disk )

So I think now I KNOW it's possible, the problem is that makomk retrieved only keys that looked like bitcoin addr. starting with 1... it didnt retrieve the other wallets of the other alt-coins

Pywallet does read raw disks, look in the help for the 4 commands starting with --recov. See http://pywallet.tk/ too, "Read a device to find deleted keys (CLI only)".
It definitely works on Linux, I tested it myself.
 
Also, as it looks for private keys, all your private keys are put in the recovered wallet. Bitcoin, Litecoin or whatever.

This is amazing, thank you. Are you the creator of this tool? It's a life safer.
I'm doing the raw recovery now & it will take some time.
 Excuse the (probably) dumb question, but what is "Gio"?
Is it the same as gigabytes?  1 Gio = 1 GB ?

I didn't create it, it's joric. His version "only" had wallet dumping and importing though.
I added the rest, including the recovery.

'o' means 'B'. Pywallet accepts both.
And the 'i' indicates that you're using a binary prefix. http://en.wikipedia.org/wiki/Binary_prefix
 (long story short, 1024**3 instead of 1000**3)
Both binary and SI prefixes are accepted.


As for the error, I'll look at that right now

[jackjack]

Ok I get it, wait a bit I'll push a fix soon

Done


Edit: Are your wallets encrypted? Because I just remembered they can't be recovered (the recovery feature is old and never draw much attention) but I can add this if you need it.

[Praxis]

Ok I get it, wait a bit I'll push a fix soon

Done


Edit: Are your wallets encrypted? Because I just remembered they can't be recovered (the recovery feature is old and never draw much attention) but I can add this if you need it.

You're the best.  

Yes, they were encrypted. Would it be possible to recover those?

[jackjack]

I'm glad it's appreciated!

It will be possible if there's a common pattern. I'm working on it now, I'll come back to report any info.
Also, maybe there's still a copy of your wallets before you encrypt them on the disk, so try anyway with the current version.

Edit: Wow, that's soooo slow! I'll try to make it faster once I'm done with encrypted wallets support

[jackjack]

Good news, I found the pattern.
How much time can you wait by the way? Could you wait for a few days?

[Praxis]

Good news, I found the pattern.
How much time can you wait by the way? Could you wait for a few days?

Awesome!! I'm so happy to hear.
Sure I will wait - the only alternative is loosing all the coins from all the wallets!
I can work on my PC anyway ... this Xubuntu USB Live OS is good enough for the time being.
I won't touch the drive of course.

[Praxis]

Also import finished, with your new pywallet:

Importing key  111/111:
Address (Bitcoin): 1BKGXf9pFg14XK38Sbj6w44dLE3jYABZdp

It seems though only addresses starting with "1" were found.
Not sure which wallet was that.

I had lots of Worldcoins for instance but no address starting with "W" was found. I wonder if it's because it was encrypted?

[jackjack]

All the addresses found will have the Bitcoin format. Keep in mind that this format in nearly never used in the wallet (only for labels) though.
AFAIK all the altcoins have the same wallet format than Bitcoin, so putting the recovered wallet in the altcoin dir and making a rescan should (must!) work.

Also, yes the current pywallet won't ever find any encrypted key so that's why.

By the way, everything's working now. I still have to make things clean, pretty and practical but it's definitely working with encrypted private keys. I'll push the update in around 24 hours.

[jackjack]

I don't have access to a Linux computer for the whole week-end... And Windows refuses to let me read raw disks correctly so you'll have to wait a bit more.

[jackjack]

Ok, use pywallet 2.1.0b1: http://pastebin.com/raw.php?i=zU2x7amw
The recovery now runs with encrypted+unencrypted on linux+windows

[Praxis]

Ok, use pywallet 2.1.0b1: http://pastebin.com/raw.php?i=zU2x7amw
The recovery now runs with encrypted+unencrypted on linux+windows

Wonderful! Going to try it now.

[Praxis]

I'm having some problems running it. I'm currently in a Linux LiveCD environment (running Manjaro which is a Arch-linux based distro, from an USB key). I tried to run the py with ./sudo pywallet.py after having chmod +x it, and it gives me this:

Code:

[manjaro@manjaro Code]$ ls
bsddb3-6.0.0/  pywallet.py*  pywallet.py~

[manjaro@manjaro Code]$ sudo ./pywallet.py
: No such file or directory

I thought it was a problem of me not having the bsddb that you write is a requirement, so I installed it, but it's still the same.
 

Code:

[manjaro@manjaro Code]$ python --version
Python 3.3.2

[manjaro@manjaro Code]$ python
Python 3.3.2 (default, May 21 2013, 15:40:45) 
[GCC 4.8.0 20130502 (prerelease)] on linux
Type "help", "copyright", "credits" or "license" for more information.

>>> help('modules')

Please wait a moment while I gather a list of all available modules...

Within the list of modules, I see a long list, the relevant part is here:

Code:

[b]...[/b]
_bisect             base64              ipaddress           smtpd
_bz2                bdb                 itertools           smtplib
_codecs             binascii            json                sndhdr
_codecs_cn          binhex              keyword             socket
_codecs_hk          bisect              lib2to3             socketserver
_codecs_iso2022     [b]bsddb3 [/b]             linecache           spwd
[b]...[/b]

If I try to run it like this, I get the following error:

Code:

[manjaro@manjaro Code]$ sudo python pywallet.py
  File "pywallet.py", line 845
    _p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2FL
                                                                           ^
SyntaxError: invalid syntax

What do you think could be the issue? Should I load Ubuntu on the USB instead?

[jackjack]

Yeah sorry I'll put a specific error about that... You need python 2.*, pywallet can't run with python 3

[Praxis]

Yeah sorry I'll put a specific error about that... You need python 2.*, pywallet can't run with python 3

oh, thanks for the fast reply!! Got it! Let me retry with python2