Bitcoin Forum
September 25, 2018, 12:33:32 PM *
News: ♦♦ New info! Bitcoin Core users absolutely must upgrade to previously-announced 0.16.3 [Torrent]. All Bitcoin users should temporarily trust confirmations slightly less. More info.
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: how I rescued my wallet.dat  (Read 176 times)
marilyn4325
Full Member
***
Offline Offline

Activity: 229
Merit: 104



View Profile
December 23, 2017, 07:28:23 PM
 #1

Two years ago I formatted my harddisk and installed Windows 10 on it. Before this I did a backup, but unfortunately the backup was broken. So I lost my wallet.dat, with a few Bitcoins in it. I could restore some files with RStudio, and I had older backups for the rest, but seemed to be that the latest wallet.dat was already overwritten, and I frequently add new addresses. So I gave up, not a big deal, maybe $200 lost. But I didn't use the harddisk and bought a new one.

Fast forward to December 2017: Now a few Bitcoins is some serious money, so I decided to give it another try. I tried any option I could find in RStudio, checking the dozens of filesystems it reported after scanning it for hours (only a few where valid from previous installations), but I couldn't restore it. Ok, this needed some more work.

My assumption was, that the file headers were broken, so I wrote a small C program myself, which scanned the whole harddisk for the wallet.dat signature (testing for the first 16 bytes). The filesystem was NTFS, which has 4k sector sizes and a file starts always at sector start, if I understand it correctly, which makes things easier. Also usually if there is enough space, contiguous sectors are used to save a file. My hope was that somewhere I could find old version of the wallet.dat, but not too old that the new keys were missing.

This is the very simple and straightforward scan program I hacked together:

Code:
#include <stdio.h>
#include <stdint.h>
#include <inttypes.h>
#include <string.h>

uint8_t buf[4096];
char filename[1000];

uint8_t search[] = {
    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x31, 0x05, 0x00
};

int main(int argc, char** argv)
{
    uint64_t pos = 0;
    FILE* f = fopen("/dev/sdd", "rb");
    FILE* w = NULL;
    int walletNumber = 0;
    int walletIndex = 0;
    uint64_t max = 1000000000000ULL;
    while (1) {
        int c = fread(buf, 1, 4096, f);
        if (c != 4096) break;
        if (!w) {
            if (memcmp(search, buf, 16) == 0) {
                sprintf(filename, "wallet%i.dat", walletNumber++);
                walletIndex = 0;
                w = fopen(filename, "wb");
                printf("found: %" PRIu64 "\n", pos);
            }
        }
        if (w) {
            fwrite(buf, 1, 4096, w);
            walletIndex++;
            if (walletIndex == 256) {
                fclose(w);
                w = NULL;
            }
        }
        pos += 4096;
    }
    fclose(f);
    return 0;
}

I used it on Linux as my host system and the old harddisk was visible as /dev/sdd (you can see this with dmesg). I compiled it with "gcc -O3 scan.cpp -o scan" and started it with "sudo ./scan", and a few hours later (it was a 1 TB harddisk) I got a wallet0.dat to wallet9.dat, each 1 MB in size (it doesn't matter if there is crap after the wallet data). This was a nice start Grin

Then I tried to copy it to a wallet.dat of a current Bitcoin installation, but most of the time it said the wallet was corrupt, once it even crashed at start and when it said it could salvage some information, no keys were in it.

My rescue was https://github.com/joric/pywallet This program could decode all files and output it in JSON format. It needs the wallet.dat in a bitcoin-qt installation in the .bitcoin directory. I knew one of my old addresses, so I wrote a script which did test all files (actual key changed) :

Code:
for i in $( ls wallet*.dat ); do
    echo item: $i
    cp $i .bitcoin/wallet.dat
    ./pywallet.py --dumpwallet --datadir=.bitcoin | grep -i 12QDRXssT63Pv5KTGBN2kyAvfLW3s7jxBs
done

The output looked like this:

Code:
item: wallet0.dat
item: wallet10.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet11.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet1.dat
WARNING:root:encrypted wallet, specify password to decrypt
item: wallet2.dat
item: wallet3.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet4.dat
Traceback (most recent call last):
  File "./pywallet.py", line 1706, in <module>
    main()
  File "./pywallet.py", line 1683, in main
    read_wallet(json_db, db_env, True, True, "")
  File "./pywallet.py", line 1556, in read_wallet
    parse_wallet(db, item_callback)
  File "./pywallet.py", line 1287, in parse_wallet
    for (key, value) in db.items():
bsddb.db.DBPageNotFoundError: (-30986, 'BDB0075 DB_PAGE_NOTFOUND: Requested page not found')
item: wallet5.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet6.dat
WARNING:root:encrypted wallet, specify password to decrypt
            "addr": "12QDRXssT63Pv5KTGBN2kyAvfLW3s7jxBs",
item: wallet7.dat
WARNING:root:encrypted wallet, specify password to decrypt
item: wallet8.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet9.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.

So the address was in wallet6.dat, success! I then used "/pywallet.py --dumpwallet --datadir=.bitcoin --password=mysecrectpassword > keys.txt" and I got all my keys back. In the bitcoin client I could import it with importprivkey (don't forget the "false" parameter as the last parameter, to avoid rescanning after each import, if you import multiple keys) and after the final rescan, I got my Bitcoins back. One day work for like 2 Bitcoins, which I already sold, that's a nice hourly rate Cool

Maybe this will help some other people as well. In case you rescue a lot of Bitcoins, I would really love it if you would send me some to 1ieKggPzp2DfroFBNie4ib77kHKNbJMkw.

Marilyn wishes you a merry Christmas, a merry Christmas, And a happy New Year!
1537878812
Hero Member
*
Offline Offline

Posts: 1537878812

View Profile Personal Message (Offline)

Ignore
1537878812
Reply with quote  #2

1537878812
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
marilyn4325
Full Member
***
Offline Offline

Activity: 229
Merit: 104



View Profile
December 23, 2017, 07:30:33 PM
 #2

BTW, I guess I'm drunk, but I'm so happy that I found my Bitcoins, try the last chant line from my posting as a brainwallet in https://www.bitaddress.org for a surprise Wink
andulolika
Legendary
*
Offline Offline

Activity: 910
Merit: 1000


View Profile
December 24, 2017, 09:21:11 AM
 #3

Grats for your recover Smiley, merry christmas and happy new year, I bet your thing will help a lot of people.

* *just-dice <3 * DARKCLAM.COM *Looking for developers! *
Crypto Betting Index
arjen20
Full Member
***
Offline Offline

Activity: 140
Merit: 100


Mining Maganda paba?


View Profile
December 24, 2017, 09:33:19 AM
 #4

Two years ago I formatted my harddisk and installed Windows 10 on it. Before this I did a backup, but unfortunately the backup was broken. So I lost my wallet.dat, with a few Bitcoins in it. I could restore some files with RStudio, and I had older backups for the rest, but seemed to be that the latest wallet.dat was already overwritten, and I frequently add new addresses. So I gave up, not a big deal, maybe $200 lost. But I didn't use the harddisk and bought a new one.

Fast forward to December 2017: Now a few Bitcoins is some serious money, so I decided to give it another try. I tried any option I could find in RStudio, checking the dozens of filesystems it reported after scanning it for hours (only a few where valid from previous installations), but I couldn't restore it. Ok, this needed some more work.

My assumption was, that the file headers were broken, so I wrote a small C program myself, which scanned the whole harddisk for the wallet.dat signature (testing for the first 16 bytes). The filesystem was NTFS, which has 4k sector sizes and a file starts always at sector start, if I understand it correctly, which makes things easier. Also usually if there is enough space, contiguous sectors are used to save a file. My hope was that somewhere I could find old version of the wallet.dat, but not too old that the new keys were missing.

This is the very simple and straightforward scan program I hacked together:

Code:
#include <stdio.h>
#include <stdint.h>
#include <inttypes.h>
#include <string.h>

uint8_t buf[4096];
char filename[1000];

uint8_t search[] = {
    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x31, 0x05, 0x00
};

int main(int argc, char** argv)
{
    uint64_t pos = 0;
    FILE* f = fopen("/dev/sdd", "rb");
    FILE* w = NULL;
    int walletNumber = 0;
    int walletIndex = 0;
    uint64_t max = 1000000000000ULL;
    while (1) {
        int c = fread(buf, 1, 4096, f);
        if (c != 4096) break;
        if (!w) {
            if (memcmp(search, buf, 16) == 0) {
                sprintf(filename, "wallet%i.dat", walletNumber++);
                walletIndex = 0;
                w = fopen(filename, "wb");
                printf("found: %" PRIu64 "\n", pos);
            }
        }
        if (w) {
            fwrite(buf, 1, 4096, w);
            walletIndex++;
            if (walletIndex == 256) {
                fclose(w);
                w = NULL;
            }
        }
        pos += 4096;
    }
    fclose(f);
    return 0;
}

I used it on Linux as my host system and the old harddisk was visible as /dev/sdd (you can see this with dmesg). I compiled it with "gcc -O3 scan.cpp -o scan" and started it with "sudo ./scan", and a few hours later (it was a 1 TB harddisk) I got a wallet0.dat to wallet9.dat, each 1 MB in size (it doesn't matter if there is crap after the wallet data). This was a nice start Grin

Then I tried to copy it to a wallet.dat of a current Bitcoin installation, but most of the time it said the wallet was corrupt, once it even crashed at start and when it said it could salvage some information, no keys were in it.

My rescue was https://github.com/joric/pywallet This program could decode all files and output it in JSON format. It needs the wallet.dat in a bitcoin-qt installation in the .bitcoin directory. I knew one of my old addresses, so I wrote a script which did test all files (actual key changed) :

Code:
for i in $( ls wallet*.dat ); do
    echo item: $i
    cp $i .bitcoin/wallet.dat
    ./pywallet.py --dumpwallet --datadir=.bitcoin | grep -i 12QDRXssT63Pv5KTGBN2kyAvfLW3s7jxBs
done

The output looked like this:

Code:
item: wallet0.dat
item: wallet10.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet11.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet1.dat
WARNING:root:encrypted wallet, specify password to decrypt
item: wallet2.dat
item: wallet3.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet4.dat
Traceback (most recent call last):
  File "./pywallet.py", line 1706, in <module>
    main()
  File "./pywallet.py", line 1683, in main
    read_wallet(json_db, db_env, True, True, "")
  File "./pywallet.py", line 1556, in read_wallet
    parse_wallet(db, item_callback)
  File "./pywallet.py", line 1287, in parse_wallet
    for (key, value) in db.items():
bsddb.db.DBPageNotFoundError: (-30986, 'BDB0075 DB_PAGE_NOTFOUND: Requested page not found')
item: wallet5.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet6.dat
WARNING:root:encrypted wallet, specify password to decrypt
            "addr": "12QDRXssT63Pv5KTGBN2kyAvfLW3s7jxBs",
item: wallet7.dat
WARNING:root:encrypted wallet, specify password to decrypt
item: wallet8.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
item: wallet9.dat
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.

So the address was in wallet6.dat, success! I then used "/pywallet.py --dumpwallet --datadir=.bitcoin --password=mysecrectpassword > keys.txt" and I got all my keys back. In the bitcoin client I could import it with importprivkey (don't forget the "false" parameter as the last parameter, to avoid rescanning after each import, if you import multiple keys) and after the final rescan, I got my Bitcoins back. One day work for like 2 Bitcoins, which I already sold, that's a nice hourly rate Cool

Maybe this will help some other people as well. In case you rescue a lot of Bitcoins, I would really love it if you would send me some to 1HagWYdLaFRbXwUfzbuWzcDc4WzmsRGqg7.

Marilyn wishes you a merry Christmas, a merry Christmas, And a happy New Year!
That was a roller coaster of a ride  Shocked, you were very lucky and that was a great christmas present for you. If only I could have found old wallet dats I mined, but of course I am a late adopter in terms of you all. I would love to one day say that I made a great decision to invest in bitcoin, again great job to you and I am glad you found the very thing that has made you happy this year! Merry Christmas!

marilyn4325
Full Member
***
Offline Offline

Activity: 229
Merit: 104



View Profile
December 24, 2017, 10:29:38 PM
 #5

BTW, I would have expected that the 0.05 BTC I donated to the brainwallet (with the Bitcoin address 1AF6eZBqwP4cStwJtfSPDTtqsjd6PXMFNA) would have claimed by now. Maybe read my second post in this thread again Grin Note: in case someone already imported the private key, you should really transfer it to another address, before someone else does this.
minersday
Hero Member
*****
Offline Offline

Activity: 742
Merit: 506



View Profile
December 24, 2017, 10:33:55 PM
 #6

Congratz mate,  you seriously have an incredible luck that no one is able to have everyday! Specially on Christmas.

Congratulations for you, i guess that this has probably be one of the most beautiful christmas gift that you could receive right? like $26,000 just for doing nothing...

I hope that something like this is just going to happen to me.. only that i have never mined before and i have never stored before, because i have been trading with all the funds that i have on my wallet right now.

Are you going to hold them all or are you going to cash them out?

BTW, I guess I'm drunk, but I'm so happy that I found my Bitcoins, try the last chant line from my posting as a brainwallet in https://www.bitaddress.org for a surprise Wink

                ▄▄▓▓█▓▓█▀▀▀▀█▓▓██▓▄▄
             ▄▓█▓▀                ▀▓█▓█
          ▄▓█▓      ▄▄▄▓▓▓▓▓▓▄▄▄      ▀█▓▄
        ▄▓██    ▄▓▓██████████████▓▓▄    ██▓▄
       ▓██    ▓▓████████▓▀▀██████████▓    ██▓
      ▓█░   █▓█████▓▀ ▓██  ▓██ ▀▓▓█████▓    ▓▓
     ▓█    ▓█████▀  ▄▓▓██████▓▓▓▄  ▓████▓    ██
    ▓██   █████▓ ▄▓▓  ▄██░▐███▄ ▀▓▓ ░▓███▓   ██▓
    ██    █████ █▓  ▓████░▐████▓█ █▓ ░█████   ██
    ██   ▐████ ▐█  ▓█████░▐██████░ █▌ █████   ██░
    ██   ▐████ ▐██ ▓█████░▐█████▓ █▓ ░█████   ██░
    ██    ████▓ █▓█ ▀▓▓██░▐██▓▓  █▓  ▓████    ██
    ▐█▓  ░████▓▄  ▀▓▓▄▄██░▐███▄▓▓  █▓████░   ██▌
     ▐██    ▓████▓▄▄  ▀██░▐███  ▄▓▓████▓░   ██▓
      ▐█▓    █▓██████▓▓██████▓▓████████    ▐█▓
       ▐█▓▄    ▀▓██████████████████▓▀    ▄▓██
         ▐█▓▄     ▀▀▓▓████████▓▓▀▀     ▄▓██
            ▓██▄                    ▄█▓▓▀
              ▀▓█▓▓▄▄          ▄▄▓▓█▓▀
                   ▀▀▓▓██████▓▓▀▀
██
██
██
██
██
██
██
.Together we can change
❍ ❍ ❍........the internet........❍ ❍ ❍
██
██
██
██
██
██
██
.Social Media.
▄███████████████████▄
██████████████████████▌
██████████████████████▌
████████████     █▀███▌
███   █████        ▐██▌
███               ▐███▌
███               ████▌
████             █████▌
█████▄▄         ██████▌
████         ▄████████▌
██████████████████████▌
██████████████████████▌
▄▓█████████████████████▓▓▄
▓██████████████████████████▌
███████████████████▓▓▀  ▓██▌
██████████████▓▀▀       ▓██▌
████████▓▀▀      ▄█    ▐███▌
███▓▀        ▄▄▓▀      ▓███▌
███▓▄▄▄   ▄▓█▓         ████▌
████████▓ ▓▌          ▓████▌
█████████▓    ▄       █████▌
██████████▌ ▄▓██▓▄   ▐█████▌
███████████████████▓▓██████▌
▐██████████████████████████
  ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
.
                  ,▄▄▄▄▄▄▄
               ▄████▀▀▀▀████▄
             ▄███`  ,▄▄,   ▀██▄
            ▐██▀  ▄███████   ██▌
          ,▄███   ████████▌  ▐██▄,
      ,▄███████▄  █▄▄██▄▄█  ▄███████▄▄
     ██████████████████████████████████,
    ▐████▌   ██████████████████   ▐█████
     ▀████▄▄████████▀  "████████▄▄████▀
       `▀████████████▄▄████████████▀▀
            '▀▀▀▀▀█████████▀▀▀▀
         ▄▄                      ▄▄
        ███          ▄▄⌐         ███
       ███           ██▌          ▀██
      ███            ██▌           ▀██
                     ██▌
marilyn4325
Full Member
***
Offline Offline

Activity: 229
Merit: 104



View Profile
December 24, 2017, 10:48:57 PM
 #7

I already cashed it out. Now I'm syncing the Bitcoin Cash wallet and then importing the private keys to this wallet again, because of course there was Bitcoin on it at August 1st this year. Current exchange rate is 0.2 BTC for one Bitcoin Cash. Probably I will convert it on Poloniex and hold it as Bitcoin then.
morbius55
Full Member
***
Offline Offline

Activity: 128
Merit: 100


View Profile
December 24, 2017, 11:19:15 PM
 #8

Why didn't you just use pywallet to scan the drive from the start? Was there an advantage to using your program first?.
bitart
Hero Member
*****
Offline Offline

Activity: 980
Merit: 583


Vires in Numeris


View Profile
December 24, 2017, 11:23:11 PM
 #9

I already cashed it out. Now I'm syncing the Bitcoin Cash wallet and then importing the private keys to this wallet again, because of course there was Bitcoin on it at August 1st this year. Current exchange rate is 0.2 BTC for one Bitcoin Cash. Probably I will convert it on Poloniex and hold it as Bitcoin then.
And also don't forget about Bitcoin Gold and about the recent 'noname' forks too Smiley
I have no experience with Bitcoin Gold yet, but be really careful there were problems with their desktop wallet install, so if you want to mess with it, take care about your existing coins.
I have just found this topic, the brain wallet donation was a nice idea, but you should have taken into account that this is holiday season, so there were a few members only to grab those coins from that brainwallet. As I see it took more than a day for someone to find your topic and to find the hidden treasure  Smiley

Haslett5236
Hero Member
*****
Offline Offline

Activity: 840
Merit: 500



View Profile
December 24, 2017, 11:29:30 PM
 #10

I already cashed it out. Now I'm syncing the Bitcoin Cash wallet and then importing the private keys to this wallet again, because of course there was Bitcoin on it at August 1st this year. Current exchange rate is 0.2 BTC for one Bitcoin Cash. Probably I will convert it on Poloniex and hold it as Bitcoin then.
congratulation found back your coin , there are easy to get your bitcoin cash , you just need to

put your privkey to blockchian.info wallet and then you can use it .

                 ▄▄▄▄███████▄▄▄
              ▄███████████████████▄
           ▄█████████████████████████▄
         ▄█████████████████████████████▄
        █████████████████████▀ █████████▄
       ██████████████████▀    ████████████
      ▐████████████████▌      ████████████▌
      ███████▀▀▀   ███▌     ▀▀█▀ █████████
      ███████████▄▄▄▀▀▀         ▄██████████
      ██████████████████▄▄▄▄▄▄▄▄▄██████████
      ▐███████████████████████████████████▌
       ███████████████████████████████████
        █████████████████████████████████
         ▀█████████████████████████████▀
           ▀█████████████████████████▀
             ▀▀███████████████████▀▀
                 ▀▀▀█████████▀▀▀
chynge.net

██
██
██
██
██
██
██
██
██
██
██
██
██


██
██
██
██
██
██
██
██
██
██
██
██
██
 
               █▀▀▀▀▀▀█             
              ▄██▄███▄         ▄   
              ▀▀ █▌ ▀▀█▀██   ▄█▀██
          ▄▄▄           ▀▀▀███▀▀▀ 
          ▀▀▀                ▀█   
      ▄▄▄▄▄▄▄                ███   
                      ▄██▀     ▐█ 
   ▄█████████      ▄█▀█▀        █▌
                 █▀▀▄█         ██▌
 ████████████   ▀█▄█▀           █▌
                                █▀
     ████████                ▄▄██ 
                             ▄█▀   
        ▀▀▀▀▀               █▀     
                  ▄     ███▀       
              ████████▀█▀           


Instant Settlement
 
                ▄██▄███           
   ▄▄▄▄▄▄▄▄▄▄▄▄█▀▄█▀   ▀█▄▄▄▄▄▄▄▄▄▄
 ██▀ ▄▄ ▄▄▄ ██▀▄██  ▄█▄  ██▌▄ ▄▄▄ █
███▀     ▐█▀▀▄█▀  ██▀ ▀██  ▀█▄    █
██      █▀░██▀  █▀▀     ▐▀█  ▀██  █
█▀▀████████████████████████████████
█▀▀▌ ██ ▄█▄ ██ ▄█▄ ██ ▄█▄ ██ ▄█▄ ██
█▄                                █
█▄                       ▄▄████████
█▄                      █▀███▌    █
█▄                     █▌ █  █▌   █
█▄                      ▀████▌▄▄▄▄█
█▄                                █
█▌                                █
██▀▀ ██ ▐█▌ ██ ▐█▌ ██ ▐█▌ ██ ▐█▌ ██
 ▀▀████████████████████████████████


Zero Fees
 
            ▄██▀▀▀██▄           
          ▄██       ██▄         
         ██           ██         
         ██           ██         
         ██           ██         
         ██           ██         
    █████████████████████████   
    █                       █   
    █          ▄▄▄          █   
    █         █▀▀▀█         █   
    █         █   █         █   
    █         █▄▄▄█         █   
    █          ▀▀▀          █   
    █▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄█   
    █▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀█   
    █████████████████████████   


Secure Transaction
marilyn4325
Full Member
***
Offline Offline

Activity: 229
Merit: 104



View Profile
December 25, 2017, 12:17:53 AM
 #11

Why didn't you just use pywallet to scan the drive from the start? Was there an advantage to using your program first?.

I don't think that pywallet can do a low-level scan of the harddisk, it expects a wallet.dat file. And Python would be very slow anyway compared to my C program.
morbius55
Full Member
***
Offline Offline

Activity: 128
Merit: 100


View Profile
December 25, 2017, 01:05:29 PM
 #12

Why didn't you just use pywallet to scan the drive from the start? Was there an advantage to using your program first?.

I don't think that pywallet can do a low-level scan of the harddisk, it expects a wallet.dat file. And Python would be very slow anyway compared to my C program.
Would love to try it but I would need some detailed noob instructions.  I have a 500 gig drive that had 32 BTC on it, so you see why I would want to give it a try  Smiley. Merry Xmas to you.
marilyn4325
Full Member
***
Offline Offline

Activity: 229
Merit: 104



View Profile
December 25, 2017, 05:59:01 PM
 #13

Would love to try it but I would need some detailed noob instructions.  I have a 500 gig drive that had 32 BTC on it, so you see why I would want to give it a try  Smiley. Merry Xmas to you.

Shocked Wow, that's some serious money, like half a million dollar, and even like $90k for Bitcoin Cash, if the Bitcoin was there at August 1st.

First you should turn off the PC immediately, if you are still using the harddisk. Install Windows or Linux on a new harddisk. Then add the harddisk as a second disk, from which you don't boot. You can then scan the second harddisk. If you are using Linux on your new harddisk (I used Debian Linux), you can see how the disk is labeled with the "dmesg" command (executed as root), e.g. /dev/sdc. Then you can use my program with this device name, which will create the wallet files, and then you can scan each file as described.

If you have problems, I can help you by PM, or a private room on https://hack.chat (my spoken English is not so good, better chat), and/or Teamviewer. If I'm successful, would be nice to get one of your Bitcoins, this would really motivate me Grin But any good computer professional with Linux experience could do the same for you. Just watch him/her not to steal your 32 BTC when found, so best someone on site.

For 32 BTC it could be even worth to try more advanced rescue functions, like if the wallet is fragmented, if the harddisk was very full, to try analyze the sectors and NTFS header entries in depth with a program or even manually for a few days. Also you could try first to use RStudio and a full disk scan (there is a free trial version, with which you can see if it finds anything, and you need the full version to rescue the file). If you are lucky, you don't need anything more special. As always, install it on a new harddisk and don't write anything on your old harddisk, and don't boot from your old harddisk. If you try other rescue programs, make sure they don't modify the original disk, but restore files to a new harddisk (RStudio is very professional, it does this).

Might be also a good idea to backup the full harddisk first with a program like Ghost: https://www.wikihow.com/Ghost-a-Hard-Drive If in doubt, get the help from a professional before you lose the coins forever.
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!