[Data Recovery Problem] Recovering many Wallet.dat from repartitioned Hard drive

[Praxis]

I just tried

Code:

sudo python2 ./pywallet.py

and it works!!

Going to run the recover now

This is quite the adventure. I'd never thought something like this could be fun, but it actually is in a strange way , even though real money is at stake ... !

Fingers crossed now

[1715205898]

1715205898

[Kouye]

Agreed, I had to install, had pywallet working - I didn't have python on my computer, and understand how to use it...
Was a lot of fun, even more since I managed to google for it from scratch, and finally succedeed.

Great tool, I agree with D&T it's a shame jackjack didn't receive more tips for it. Sending one (small tip, I'm pooooor!!!) now, in memory of this precious moment where it worked.

[Praxis]

Works now, it asks me for all the passphrases, I typed all the passes that I remember - I'm sure about the passes for the most important wallets - ... after all this, it gives me this:

Code:

Starting recovery.
Can't open /dev/sda, check the path or try as root
[root@manjaro Code]# 

Which is odd, since I am running this as root, and /dev/sda is the right path:

Code:

[root@manjaro Code]# fdisk -l

WARNING: fdisk GPT support is currently new, and therefore in an experimental phase. Use at your own discretion.

Disk /dev/sda: 640.1 GB, 640135028736 bytes, 1250263728 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk label type: gpt


#         Start          End    Size  Type            Name
 1          162   1241514017    592G  unknown         
 2   1243977728   1250263023      3G  Linux swap      
 3   1250263074   1250263689    308K  unknown         

Is it because I run it with "python2 pywallet.py" instead of "./pywallet.py" - I think it shouldn't matter, I still ask

Otherwise I'll try a different Linux LiveCD. Sorry for so many questions. As Kouye has said you deserve fat tips for your work, when I get my hands on the lost coins I will donate a significant amount of my coins.

[jackjack]

Thanks for the kind words+tips guys

Praxis: Try with a specific partition, like /dev/sda1
I never tried the whole disk sda so I'm not sure it works

Is it because I run it with "python2 pywallet.py" instead of "./pywallet.py"

Nope
And changing the LiveCD shouldn't change anything

[Praxis]

Same error if I run with /dev/sda or /dev/sda1 or /dev/sdaX... "Can't open /dev/sda, check the path or try as root" ...

But with the old version of pywallet, I ran it on /dev/sda and it worked well. In fact, the old version works on /dev/sda or any other, /dev/sdax

I just tried again the old version :

Code:

[root@manjaro Documents]# python2 pywalletOld.py --recover --recov_device /dev/sda --recov_size 30Gio --recov_outputdir /home/manjaro/Documents/

0.00/32.21 Go
   ETA: 07:00:09

0.01/32.21 Go
   ETA: 01:04:14

0.02/32.21 Go
   ETA: 01:04:14

My partition table is currently a clusterfuck but it shouldn't be the reason, since with old pywallet I can scan /dev/sda directly. It's really strange, I can't understand.

[jackjack]

I'm using windows since yesterday so I think I made a windows fix that broke it...
Sorry for this, I'll give it a look a bit later

[scintill]

Have you tried guessing the old partition table with gpart?  Gparted has a nice UI frontend that will scan for partitions, then let you mount them.

If all that's happened is your partition table is gone, you have pretty good chances of finding your filesystems entirely intact, you just have to find where they are located on the disk.

[Praxis]

Have you tried guessing the old partition table with gpart?  Gparted has a nice UI frontend that will scan for partitions, then let you mount them.

If all that's happened is your partition table is gone, you have pretty good chances of finding your filesystems entirely intact, you just have to find where they are located on the disk.

Thanks for the ideas. Problem is, I made new partitions, not just deleted the old ones.haven-t done anything except making new partitions though. No idea how Gparted could restore my old partition table ...

the good news is that I feel I'm really close to recovering wallets with jackjack's pywallet after he made the changes to scan encrypted wallets

[trilightzone.org]

Have you tried guessing the old partition table with gpart?  Gparted has a nice UI frontend that will scan for partitions, then let you mount them.

If all that's happened is your partition table is gone, you have pretty good chances of finding your filesystems entirely intact, you just have to find where they are located on the disk.

Thanks for the ideas. Problem is, I made new partitions, not just deleted the old ones.haven-t done anything except making new partitions though. No idea how Gparted could restore my old partition table ...

the good news is that I feel I'm really close to recovering wallets with jackjack's pywallet after he made the changes to scan encrypted wallets

Maybe for the next time but if something like this happens it's important to first make a raw disk image and store it somewhere as a backup. Then work on the drive to get your data back. In case something goes wrong you at least have a raw backup image of the drive.

Hope with the good tools in this thread you'll get everything back or at least the important wallets !

[scintill]

Thanks for the ideas. Problem is, I made new partitions, not just deleted the old ones.haven-t done anything except making new partitions though. No idea how Gparted could restore my old partition table ...

the good news is that I feel I'm really close to recovering wallets with jackjack's pywallet after he made the changes to scan encrypted wallets

It depends, if by "make" new partitions that includes formatting them, then it does hurt your chances pretty badly.  Gparted scans the disk for filesystem signatures and can deduce the partitions' start and size from those.  If all you've done was delete the partition table and allocate space for new partitions, those signatures and all the rest of the data needed to store the old files would still be there.

Even if you formatted the new partitions, it might still be able to find something if the beginnings of the old and new partitions happened to be far enough apart, but it seems like a slim chance, and maybe you don't need to try it if you're making progress with pywallet.

[jackjack]

Pretty dumb I don't print the error when it crashes...
Done here 2.1.0b3: http://pastebin.com/raw.php?i=pXXh2bNF

You will still get the "path or try as root" error but the line just below will give some additional details

[Praxis]

Code:

Starting recovery.
Can't open /dev/sda, check the path or try as root
("'module' object has no attribute 'O_BINARY'",)

[jackjack]

2.1.0b4 should work: http://pastebin.com/raw.php?i=wmXTdQrf

[Praxis]

Works!! You're awesome! I run the proccess now

[jackjack]

Great
Good luck

[Praxis]

I think these might be some great news :

Code:

640.00 Go read
640.10 Go read
Found 46 possible wallets
Found 8414 possible encrypted keys
Found 5443 possible unencrypted keys

Possible wallet #1
with passphrase #1 

 [manjaro@manjaro ~]$ 

So, it works! Even for encrpyted wallets!

As far as I know pywallet is now the only program that can do this

Problem is, I can't find the output wallet.

This was my parameter in the command line:

Code:

--recov_outputdir /home/manjaro/Documents/

The folder exists and I ran it as root so there is write access.

But the file isn't there after it finished.

Sorry for nagging you so much  

[Praxis]

Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly.

[jackjack]

Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly.

That's exactly what I was about to ask you: did it stop just after "Possible wallet #1 with passphrase #1 "? Nothing printed after this?
If so, it definitely crashed
I'll try to see what could have happened and report here

[Praxis]

Looks as if it finds all keys/wallets, even the encrpyted ones, but then it should go into phase 2 - applying the passwords - but there it just quits the program, if I understand correctly.

That's exactly what I was about to ask you: did it stop just after "Possible wallet #1 with passphrase #1 "? Nothing printed after this?
If so, it definitely crashed
I'll try to see what could have happened and report here

Yes. If there's any other information I can give, let me know. Anything that could help.
Sadly my Python skills don't go a lot further than a hello world program.

[jackjack]

For now I really don't see what could make it crash
Also you'll have to scan all the drive again the next time you'll run the recovery I'm sorry for that...

Good news though, I just coded the creation of a partial file that keeps useful offsets before the crash, so you'll have to run the long disk reading only once more (you should do it now)
You don't have anything special to do: run the same command and pywallet will save 'pywallet_partial_recovery_timestamp.dat' in the outputdir before crashing
Next time you run a recovery, change

Code:

--recov_device=c:\

to

Code:

--recov_device=PartialRecoveryFile:c:\path\to\pywallet_partial_recovery_timestamp.dat

2.1.0b5
http://pastebin.com/raw.php?i=xi4ivsCH