Bitcoin Forum
September 20, 2019, 11:23:52 PM *
News: Latest Bitcoin Core release: 0.18.1 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1] 2 »  All
  Print  
Author Topic: Help me to recover 33.54 BTC from a corrupt wallet.dat, I'll pay you a Reward!  (Read 970 times)
ketubi
Newbie
*
Offline Offline

Activity: 3
Merit: 0


View Profile
December 16, 2017, 01:03:34 AM
 #1


Hi folks! I have a Old corrupt wallet.dat from a client. I tried some things to recover those 33.54 BTC, since July 16. This is the wallet:

https://blockchain.info/address/1KYYVUwWSMrNkje41jzvubSRsjABu3EUt6

Next, a short summary of the history of this wallet:

*) This wallet comes from a old version of bitcoin-qt (2011), my client said "0.3.24 Beta version", but that is not sure. He remember, he could mining with that client of bitcoin-qt. In fact, he did a "copy & paste" of the wallet.dat when the client was mining and updating. Then, he put that file in a USB drive, and stored for years. When he tried to recover the wallet.dat with a new client of bitcoin-qt, bit he never had success.

*) He said, "the wallet is not encrypted with a password".

*) The size of the wallet.dat file is 112kb

What i tried, with no success :

1) I downloaded the bitcoin-qt client 0.3.24beta, and i tried to open the client with the wallet.dat loadded. i had this messagge:

https://drive.google.com/file/d/1feAvAHdS8t7e2bY3pGVRPZOtMcUgkasj/view?usp=sharing

2) I downloaded the new version of bitcoin-qt client 0.12.1 (i did in July 16), and i tried to open with the same method above.

3) I tried commands from the bitcoin-qt client 0.12.1, like "salvagewallet" and "upgradewallet".

4) I tried bitcointools.

5) Then i started to open the wallet with a HEX editor and looking for a pattern like "KeyA", "key!" or any other kind.

6) Also i tried this script: https://gist.github.com/msm595/7595164. I got 0 privkey.

7)I modified the script above, changing the line 17, with other kinds of REGEX patterns. I tried:

What i need:

*)Any Kind of help, I don't rule out that I could have tried badly some previously mentioned method.

*)Don't Waste your time, requesting the wallet.dat file. I'll not pass it on.

*)You can pass me, open source scripts writed for you, with the following steps to make it work.

*)I am a Python Developer, so i'll prefer scripts writed in that lenguage.

If your recover method, helps me to recover the wallet.dat i'll pay you a reward (We can negociate it)
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1569021832
Hero Member
*
Offline Offline

Posts: 1569021832

View Profile Personal Message (Offline)

Ignore
1569021832
Reply with quote  #2

1569021832
Report to moderator
1569021832
Hero Member
*
Offline Offline

Posts: 1569021832

View Profile Personal Message (Offline)

Ignore
1569021832
Reply with quote  #2

1569021832
Report to moderator
jackg
Copper Member
Legendary
*
Offline Offline

Activity: 1498
Merit: 1301


https://bit.ly/2FR9nyn - free python tutorials


View Profile
December 16, 2017, 01:23:21 AM
 #2

The user jackjack here wrote pywallet (you can search for it on githum and it should appear under the name jackjack-jj/pywallet).

What drive was the file on before it became corrupted? Was it in amongst other files or on its own on the drive - can you get that drive professionally recovered, have you?

HCP
Legendary
*
Online Online

Activity: 1092
Merit: 1787

<insert witty quote here>


View Profile
December 16, 2017, 02:55:23 AM
 #3

I hope you have the original copy of the wallet... and have not been attempting to recover after you used "salvagewallet". Salvagewallet can make things worse.

But yes... give pywallet a try: https://bitcointalk.org/index.php?topic=34028.0

ccie38216
Newbie
*
Offline Offline

Activity: 9
Merit: 0


View Profile
December 16, 2017, 06:56:05 AM
 #4

Hopefully you have an orginal backup copy of your wallet.dat prior to trying to "recover" it.

Download pywallet and launch it, the web interface is pretty straight forward.

You can dump the wallet to JSON format which would include the private key which you could import into electrum.

Hopefully this wallet.dat was before encryption in which case you won't need a passphrase Wink
ketubi
Newbie
*
Offline Offline

Activity: 3
Merit: 0


View Profile
December 16, 2017, 07:36:09 AM
 #5

Thanks for the response, i tried to dump my wallet and i get "error un dump page". See the image

https://drive.google.com/file/d/1VriRG4hyGxcqBNRL5QL7x7Wzl4QR185X/view?usp=sharing
ketubi
Newbie
*
Offline Offline

Activity: 3
Merit: 0


View Profile
December 16, 2017, 07:44:37 AM
 #6

The user jackjack here wrote pywallet (you can search for it on githum and it should appear under the name jackjack-jj/pywallet).

What drive was the file on before it became corrupted? Was it in amongst other files or on its own on the drive - can you get that drive professionally recovered, have you?

Thanks for the response, my client doesn't have the original drive where the wallet was not corrupted.
Bitsky
Hero Member
*****
Offline Offline

Activity: 574
Merit: 500


View Profile
December 16, 2017, 08:07:15 AM
 #7

You might want to ask these guys: https://walletrecoveryservices.com/ after you exhausted everything you can try yourself.
They seem to have a good reputation.

Bounty: Earn up to 68.7 BTC
Like my post? Feel free to drop a tip to 1BitskyZbfR4irjyXDaGAM2wYKQknwX36Y
PaulSasquatch
Newbie
*
Offline Offline

Activity: 9
Merit: 0


View Profile
December 16, 2017, 11:16:19 AM
 #8

I don't understand. Why not use Bitcoin Core for this? I had an old wallet.dat from 2013 that worked well when I put it back in place from a stick this year.
racquemis
Full Member
***
Offline Offline

Activity: 176
Merit: 100


View Profile
December 16, 2017, 11:41:54 AM
 #9

I don't understand. Why not use Bitcoin Core for this? I had an old wallet.dat from 2013 that worked well when I put it back in place from a stick this year.

The file is corrupted... Read ops post.
SopaXT
Full Member
***
Offline Offline

Activity: 161
Merit: 112


View Profile
December 16, 2017, 02:50:28 PM
Last edit: December 16, 2017, 04:33:11 PM by SopaXT
 #10

I quickly wrote a small Python script for parsing a wallet and dumping the private keys from it (run with Python 2):

Code:
import sys
import struct
from bsddb.db import *
from hashlib import sha256

# Dumps the private keys from a wallet.dat file.
# Inspired by pywallet.
# Credits: https://bitcoin.stackexchange.com/questions/13681/opening-wallet-dat-in-python-using-bsddb3

B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

if not len(sys.argv) == 2:
    print("Usage: %s <wallet_file>" % sys.argv[2])
    sys.exit(1)

def read_size(buffer, offset):
    size = ord(buffer[offset])
    offset += 1

    if size == 0xfd:
        size = struct.unpack_from("<H", buffer, offset)[0]
        offset += 2
    if size == 0xfe:
        size = struct.unpack_from("<I", buffer, offset)[0]
        offset += 4
    if size == 0xff:
        size = struct.unpack_from("<Q", buffer, offset)[0]
        offset += 8

    return offset, size

def read_string(buffer, offset):
    offset, string_len = read_size(buffer, offset)
    return offset + string_len, buffer[offset: offset + string_len]

def b58_encode(d):
    out = ""
    p = 0
    x = 0

    while ord(d[0]) == 0:
        out += "1"
        d = d[1:]

    for i, v in enumerate(d[::-1]):
        x += ord(v)*(256**i)

    while x > 58**(p+1):
        p += 1

    while p >= 0:
        a, x = divmod(x, 58**p)
        out += B58[a]
        p -= 1

    return out

def b58check_encode(d):
    checksum = sha256(sha256(d).digest()).digest()[:4]
    return b58_encode(d + checksum)


db = DB()
db.open(sys.argv[1], "main", DB_BTREE, DB_RDONLY)

items = db.items()

for item in items:
    k, v = item
    koff, voff = 0, 0
    koff, item_type = read_string(k, koff)

    if item_type == "key":
        koff, pubkey = read_string(k, koff)
        voff, privkey = read_string(v, voff)

        if len(privkey) == 279:
            secret = privkey[9:9+32]
        else:
            secret = privkey[8:8+32]

        if pubkey[0] != "\x04":
            secret += "\x01"

        print(b58check_encode("\x80" + secret))
db.close()

It's very simple, and outputs a bunch of WIF private keys (you can paste them into Electrum's Sweep dialog for example, but if there's many of them, it's going to take a while to check their balances, so be patient.
NOTE: the method of working with the database used here is different from pywallet's. It may work better on corrupted wallets.

NOTE:
Code:
pip install bsddb
may be required, as noted by jackg below.

jackg
Copper Member
Legendary
*
Offline Offline

Activity: 1498
Merit: 1301


https://bit.ly/2FR9nyn - free python tutorials


View Profile
December 16, 2017, 04:08:08 PM
 #11

Thanks for the response, i tried to dump my wallet and i get "error un dump page". See the image



You can't dump a corrupt wallet to json as it won't have the correct format.
I quickly wrote a small Python script for parsing a wallet and dumping the private keys from it (run with Python 2):

Code:
import sys
import struct
from bsddb.db import *
from hashlib import sha256

# Dumps the private keys from a wallet.dat file.
# Inspired by pywallet.
# Credits: https://bitcoin.stackexchange.com/questions/13681/opening-wallet-dat-in-python-using-bsddb3

B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

if not len(sys.argv) == 2:
    print("Usage: %s <wallet_file>" % sys.argv[2])
    sys.exit(1)

def read_size(buffer, offset):
    size = ord(buffer[offset])
    offset += 1

    if size == 0xfd:
        size = struct.unpack_from("<H", buffer, offset)[0]
        offset += 2
    if size == 0xfe:
        size = struct.unpack_from("<I", buffer, offset)[0]
        offset += 4
    if size == 0xff:
        size = struct.unpack_from("<Q", buffer, offset)[0]
        offset += 8

    return offset, size

def read_string(buffer, offset):
    offset, string_len = read_size(buffer, offset)
    return offset + string_len, buffer[offset: offset + string_len]

def b58_encode(d):
    out = ""
    p = 0
    x = 0

    while ord(d[0]) == 0:
        out += "1"
        d = d[1:]

    for i, v in enumerate(d[::-1]):
        x += ord(v)*(256**i)

    while x > 58**(p+1):
        p += 1

    while p >= 0:
        a, x = divmod(x, 58**p)
        out += B58[a]
        p -= 1

    return out

def b58check_encode(d):
    checksum = sha256(sha256(d).digest()).digest()[:4]
    return b58_encode(d + checksum)


db = DB()
db.open(sys.argv[1], "main", DB_BTREE, DB_RDONLY)

items = db.items()

for item in items:
    k, v = item
    koff, voff = 0, 0
    koff, item_type = read_string(k, koff)

    if item_type == "key":
        koff, pubkey = read_string(k, koff)
        voff, privkey = read_string(v, voff)

        if len(privkey) == 279:
            secret = privkey[9:9+32]
        else:
            secret = privkey[8:8+32]

        if pubkey[0] != "\x04":
            secret += "\x01"

        print(b58check_encode("\x80" + secret))
db.close()

It's very simple, and outputs a bunch of WIF private keys (you can paste them into Electrum's Sweep dialog for example, but if there's many of them, it's going to take a while to check their balances, so be patient.
NOTE: the method of working with the database used here is different from pywallet's. It may work better on corrupted wallets.
A pip install of the bsddb may be required.

You might also be able to get bitcointools to turn a private key from one of the mentioned scripts and convert it to an address to scan for a balance on blockchain.info's API.
The user jackjack here wrote pywallet (you can search for it on githum and it should appear under the name jackjack-jj/pywallet).

What drive was the file on before it became corrupted? Was it in amongst other files or on its own on the drive - can you get that drive professionally recovered, have you?

Thanks for the response, my client doesn't have the original drive where the wallet was not corrupted.
How do you know this is your exact wallet.dat? Do you just think it's for bitcoin or had you put it on a specific drive to back it up which it got corrupted on. Do you have any backups of the corrupted wallet also as in if you did a full system backup at the time that you still have a copy of?

kahc
Member
**
Offline Offline

Activity: 308
Merit: 11


View Profile
December 16, 2017, 07:39:05 PM
 #12

Your unencrypted wallet.dat sounds pretty messed up if not even one 'key' related entry was found.

Take a look at this https://github.com/bitcoin/bitcoin/blob/48b5b84ee511d5ccd0d47bb0018c1b3c9ddebeff/src/wallet/walletdb.cpp
There should be plenty of entries starting or ending with 'key'.

Guess you have to resort to: https://walletrecoveryservices.com/  afterall.
SopaXT
Full Member
***
Offline Offline

Activity: 161
Merit: 112


View Profile
December 16, 2017, 09:07:22 PM
Merited by vapourminer (3)
 #13

If reading the database using the script above doesn't succeed, you can also try searching your wallet file for the hex string: "0201010420'.
It's the common value of a private key data field, and a 32 byte (64 hex characters) private key will follow.

EDIT: According to this: http://www.radjaidjah.org/index.php?post/2014/09/07/Sauver-ses-bitcoins-de-la-corruption, the full hex prefix is "fd1701308201130201010420".

CryptoMamma
Newbie
*
Offline Offline

Activity: 13
Merit: 0


View Profile
December 16, 2017, 09:21:04 PM
 #14

Geesh! I thought I had problems. I hope you manage to recover. I'm praying for you! Sending you good vibes.
KicKfrBcn
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
December 16, 2017, 09:23:58 PM
 #15

Hi ketubi,


Give this a try..!!!

Make sure you have a extra backup  Smiley

first take the wallet.dat file and split into two wallet.dat files(likely one with 80/90% data and the other with remaining)...

once you are ready with two files.. try placing the first wallet.dat file you have made and start bitcoin-qt...

if it works.. you will get to the point where you have 33.54 BTC  Smiley
if you still get the error then try to remove more lines present at the last... and again start bitcoin-qt with new file

Hope this works..!! Revert BACK ..!!

Thanks,
KicKforBcn





jackg
Copper Member
Legendary
*
Offline Offline

Activity: 1498
Merit: 1301


https://bit.ly/2FR9nyn - free python tutorials


View Profile
December 16, 2017, 11:52:54 PM
Last edit: December 17, 2017, 12:43:54 AM by jackg
 #16

Hi ketubi,


Give this a try..!!!

Make sure you have a extra backup  Smiley

first take the wallet.dat file and split into two wallet.dat files(likely one with 80/90% data and the other with remaining)...

once you are ready with two files.. try placing the first wallet.dat file you have made and start bitcoin-qt...

if it works.. you will get to the point where you have 33.54 BTC  Smiley
if you still get the error then try to remove more lines present at the last... and again start bitcoin-qt with new file

Hope this works..!! Revert BACK ..!!

Thanks,
KicKforBcn







Afaik, it doesn't append linearly new data at the end.
If I help you, what reward could I have?

Help to help the community, don't consider a monetary reward of a reason to help. Next we'll get someone asking him to sign the address with the 34btc in it.  Grin



@KicKfrBcn good find, it was from four years ago but mainly the same suggestions as what is on this thread, with extra info too!

KicKfrBcn
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
December 17, 2017, 12:32:32 AM
 #17

Jackg/ketubi..

FYI.. Almost similar issue in reddit   Wink

https://www.reddit.com/r/Bitcoin/comments/1crbne/corrupted_walletdat_with_18_btc_possible_to/


CntryBoy
Sr. Member
****
Offline Offline

Activity: 770
Merit: 251



View Profile
December 17, 2017, 01:54:35 AM
 #18

I have a similar issue with a wallet.dat file, although not nearly as many BTC as OP.  Tagging this post to keep an eye out for a possible solution.  GL OP to recover it, that is a ton of cash just hanging out there.
tomasooz
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
December 18, 2017, 05:38:41 AM
 #19

Did you find a solution for issue?

Thanks!
stevewig
Newbie
*
Offline Offline

Activity: 15
Merit: 0


View Profile
February 24, 2018, 12:37:00 AM
 #20

think I may be able to help you.

youll need a Linux box & a blank usb stick
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!