wallet.dat Recovery help! (Solved)

[Chrstian]

(im using a mac)

Hey, I have some old wallet.dat files I'm trying to recover/access. In the process of downloading bitcoin core. I tried to replace the automatically generated wallet.dat file with my wallet.dat file(s) and it gives me a "corrupted unable to recover" message,  both the wallets are very old, pre-forks.

I have since installed pywallet and its associated dependencies and get the following error when trying to dump the  VALID autogenerated wallet.dat file from the bitcoin core with pywallet.    

'ecdsa' package is not installed, pywallet won't be able to sign/verify messages

Wallet data not recognized: {'__type__': 'hdchain', '__value__': '\x02\x00\x00\x00\xe9\x03\x00\x00\xd1\xc0\x8bB\xa0\xe1G\xbe5\x11\x9bs\xe7\xe4\xac\xaf\xb1\x88\xfc\xad\xe8\x03\x00\x00', '__key__': '\x07hdchain'}

Wallet data not recognized: {'__type__': 'keymeta', '__value__': "\n\x00\x00\x00\x06\xfaGZ\x00\x00\x00\x00\x0cm/0'/0'/855'\xd1\xc0\x8bB\xa0\xe1G\xbe5\x11\x9bs\xe7\xe4\xac\xaf\xb1\x88\xfc\xad", '__key__': "\x07keymeta!\x02\x00?\x93\xc4\xf4U\xd9\xf6\x0b)Z\x1e\xfe\xf9\xc4zUz\xf1'\xb1~\xe2\x056\xf2e\x8a\x8d\x8a\x92\xa7"}

Wallet data not recognized: {'__type__': 'keymeta', '__value__':
"\n\x00\x00\x00\x05\xfaGZ\x00\x00\x00\x00\x0bm/0'/0'/51'\xd1\xc0\x8bB\xa0\xe1G\xbe5\x11\x9bs\xe7\xe4\xac\xaf\xb1\x88\xfc\xad", '__key__': '\x07keymeta!\x02\x00\x87\xe5\xed\xb8T\x0ev\x89!\x1d\xa3\xae\x17\xe1\xc7\x98\x98\x02\xd9}D\xd1s]\x18\x80R\x1cp\n\xfc'}


Basically a whole lot of wallet data not recognized messages.

this is the final message,

Traceback (most recent call last):
  File "/Users/Kainan/Downloads/pywallet-master/pywallet.py", line 2111, in parse_wallet
    d.update(parse_BlockLocator(vds))
TypeError: 'NoneType' object is not iterable
ERROR parsing wallet.dat, type bestblock
key data:    bestblock
key data in hex: 0962657374626c6f636b
value data in hex: 544a020000

______

I will be paying a bounty of at-least 200$ for assistance with this, possibly much more if there's a substantial amount in the wallet and I gain access to it.

[1714051356]

1714051356

[1714051356]

1714051356

[1714051356]

1714051356

[Chrstian]

I should note that the information above is from trying to use a valid wallet generated by bitcoin core. (qt).     Also, I dont think the wallets im trying to access are encrypted,. I tried using a hex editor finder thing and was unable to locate "keyA" 01 03 6B 65 79 41 04 in the autogenerated wallet or the old wallets.

[sgravina]

Check out this topic:

https://bitcointalk.org/index.php?topic=25091.0

It is a program that looks for bitcoin private keys on a computer disk.  I never needed it but tried it because it looked useful.  it worked back in 2013 with my wallet.  I deleted a wallet and put it to work on my disk.  It found all the keys and made a new wallet.dat file from them.

If you can't find the code I put my copy here:  http://gravina.x10host.com/thing/wallet-recover-0.3-linux.tar.gz

Give it a try.

If you do recover some old populated bitcoin addresses they may also contain Bitcoin Cash, Bitcoin Gold and Clams.

[Chrstian]

Bounty still up for grabs as I am unsure as to how I should use that tool, (also I don't have any cd's I can boot from, and I don't have any familiarity with Linux). If someone can walk me through using it on a mac or pc without a boot cd, Ill reward both the OP and you.  If an alternate easier or faster method is available ill also reward that.

[Shirase]

Try searching for fd1701308201130201010420 in the wallet using a hex editor. (Or perhaps some smaller portion like 0201010420). The next 32 bytes after that string would be your private key, assuming super old, unencrypted wallets.

Edit: Oh. Also, show how you're searching for these strings in the hex editor. (With a screenshot, and not with your wallet.dat open just so nothing private is revealed.) Most allow for searching for text and hexadecimal. Maybe you're searching for hexadecimal as text or something.

[Chrstian]

Try searching for fd1701308201130201010420 in the wallet using a hex editor. (Or perhaps some smaller portion like 0201010420). The next 32 bytes after that string would be your private key, assuming super old, unencrypted wallets.

Edit: Oh. Also, show how you're searching for these strings in the hex editor. (With a screenshot, and not with your wallet.dat open just so nothing private is revealed.) Most allow for searching for text and hexadecimal. Maybe you're searching for hexadecimal as text or something.

0201010420 returns countless results .. fd1701308201130201010420 returns nothing. Using Hex Fiend, The wallet I was attempting to search is from late 2013. Searching in Hex, I also have the ability to search in text.

I repeated search with valid up to date wallet.dat file and was unable to locate "fd1701308201130201010420"

[Chrstian]

Another update;  wallet.dat files may be corrupt.    My Bitcoin-Qt is *FINALLY* up to date. I attempted to replace the wallet.dat file with my old ones.  exact error returned is "wallet.dat corrupt, salvage failed". Same error with both older wallets I tried...

With regards to "salvage failed" error. I  played around with the valid wallet.dat file and noticed the "salvage" doesn't really try very hard.  the slightest amount of gibberish inserted into the file causes the error to appear.

[Chrstian]

Update: increasing bounty to 200$ minimum.. need to get the important info out of these wallet.dat files. Is there an easy way to see if they are encrypted? I believe both files are from late 2013

[Spendulus]

Update: increasing bounty to 200$ minimum.. need to get the important info out of these wallet.dat files. Is there an easy way to see if they are encrypted? I believe both files are from late 2013

Here is a method.

Take a known good 2013 CORE wallet, unencrypted. Run tests using suggested methods on it and establish what actually works.

Only then try the same known-good technique on the target wallet.

[Shirase]

You don't necessarily need a CD. Do you have a USB stick lying around with like 4GB you can use for this? (exclusively for this, everything else on it would be formatted/deleted. But you could use the stick again once you're done.) If you're willing to spend $200 on a bounty, you should definitely be willing to buy a USB thumbdrive, assuming you don't have one around.

Maybe have two, one can be small since it only needs to hold your wallet.dat files and the wallet-recover program rather than a whole OS.

You're on a mac, but you had said we could provided step by step instructions for Windows as well.

Linux Live USB creator will allow you to turn most bootable .iso files (CDs) into bootable USB files. There are other programs that do this, maybe someone else can post one that has been updated more recently...

You can download the portable version here so you don't have to install it: https://www.linuxliveusb.com/en/other-versions

You can download Ubuntu from here: https://www.ubuntu.com/desktop (It encourages donations, but don't worry, it's free. Just click, "Not now, take me to the download")

You should end up with an .iso file.

Extract the LinuxLive USB creator .zip file. Open LiLi USB Creator. Select the drive letter for the thumbdrive you want to use for the OS in Step 1. Click ISO/IMG/ZIP under step 2. Choose the ubuntu iso file. It will say the latest Ubuntu is not found, and will use settings for Ubuntu 15.04. That's fine.

Step 3 is for "Persistence". Drag the slider all the way to the right.

In step 4, check Format the key in FAT32.

Check, double check, triple check that the drive letter is for your thumb drive.

Click the Lightning bolt. It will take a bit of time, but will update you on progress below the lightning bolt.
https://i.imgur.com/4Fuxx5w.png

When finished it will say "Your LinuxLive key is now up and ready!" under the lightning bolt. Get another USB thumbdrive. (Easiest, so the program runs for less time since you can search only the specific drive they're on.) Copy your wallet.dat files to it. Download wallet-recover from here: http://makomk.com/~aidan/wallet-recover and place it on the stick next to your wallet.dat files. (same link as the one from the topic sgravina shared, feel free to get it from there) Safely remove this USB thumbdrive from your computer.

Turn off your computer, and boot from the USB thumbdrive with Ubuntu on it. Unfortunately, how this is done varies from bios to bios. On most of my computers continually pressing f11 and f12 immediately after starting the computer opens the boot menu. Select the USB stick with Ubuntu on it using the arrow keys and enter. (This varies too, but usually you do not have access to mouse controls in BIOS menus).

If you can get this far, it's very good because there are a lot more tools and support here for linux than anything else.

It will boot after a bit. You'll see a giant window with "Try Ubuntu" and "Install Ubuntu". You want try.

It may appear to be a black screen for a bit, depending on your USB stick's read/write speed. Don't worry. Just wait. You'll see a desktop environment and GUI. Right Click on the desktop and create a new folder. Call it wallet-recover. Open this folder.

Connect the USB stick containing your wallet.dat files and wallet-recover. Find it in the vertical column on the left of your screen. Click it to open it, and navigate to where you saved wallet-recover on it.
https://i.imgur.com/FEwr8rO.png
Copy wallet-recover (the file) to the wallet-recover folder you have open.

Right Click wallet-recover (the copy in the new wallet-recover folder, not the original on your thumb drive) and give it execution permission.
https://i.imgur.com/8Et4dDP.png

Now right click inside the wallet-recover folder and select open terminal.

Type
lsblk
in the terminal window and press enter.

It should list all drives/USB sticks connected to the computer with their sizes and a little info about them. It will also display where they are mounted. Something like sdX. You need to take note of where the USB containing your wallet.dat files is mounted.
https://i.imgur.com/XBgv1Su.png
For me, it's sdb (The lexar media you saw in the previous image)

Now type
sudo ./wallet-recover /dev/sdX recovered-wallet.dat
where sdX is where your wallet USB was mounted. You should see something like this.
https://i.imgur.com/qdrXWjU.png
If it reports that it found private keys, type
sudo chmod +r recovered-wallet.dat
in the terminal window. This will give you permission to read the file. (If for some reason you don't have that.)

Right Click recovered-wallet.dat and select copy. Right Click inside the USB thumb drive and select paste. Turn off the computer, take the thumbdrive with recovered-wallet.dat to your computer with bitcoin core. Copy it to that computer, rename it to wallet.dat, replace the wallet.dat in the directory and report back.

Edit: For what it's worth, trying pywallet on an OS you haven't tried might also be a good idea if this doesn't work.

[Spendulus]

You don't necessarily need a CD. Do you have a USB stick lying around with like 4GB you can use for this? (exclusively for this, everything else on it would be formatted/deleted. But you could use the stick again once you're done.) If you're willing to spend $200 on a bounty, you should definitely be willing to buy a USB thumbdrive, assuming you don't have one around......

Somewhat easier than this is using Virtual Box to generate a virtual Ubunto system on the Mac.

Still need known good 2013 wallet test files.

I will look around later today and see if I have any and how this works.

[Chrstian]

Wallet has been recovered via extrernal 3rd party securely, after talking with them they stated they used information pertaining to topic ::
    https://bitcointalk.org/index.php?topic=25091.0

    sgravina attempted assisting me /giving walkthrough in pm despite how much of a noob I was and for that I'll provide compensation.      Post deposit address and I'll send a gift,  btc BCH or BCG

[Chrstian]

Shirase you really put a lot of effort in also  it seems so I'll send you a little something also. Deposit address needed

[Butense]

hey i've had a lot of experience with recovering keys, I'm almost certain I could help you (as long as it's possible to recover).  Pm me your skype or something and we can have a live chat because it's easier to go back and forth.  At no point will you be at risk and I will source all of my advice from third parties.

I'll do it for free you can donate if you want but i enjoy helping people with things that are super niche like this. 

Before you hit me up, try a couple things. 

I AM REALLY SURE THE FOLLOWING WILL WORK FOR YOU.  It has a gui so no fucking around with command line shit.

https://github.com/prof7bit/wallet-key-tool/releases

I haven't found a better tool for getting keys from many types of wallets.  just run the .jar and load the .dat (make sure to select .dat filetype because it defaults to .wallet for multibit wallets).  It will load in every key (and ask for password if its encrypted). 

seriously i bet it would work with that. 

but pywallet can be weird.  Theres lots of different versions out there and the one i put in the pastebin below is the one that works for me.  put the wallet.dat on a flash drive, find the device name (on windows it would be like D:/ on unix it could be /dev/sda3 on mac /disk/disk2s3) and use pywallet recover.  It scans your storage device byte by byte looking for potential privkeys and you specify any passwords that might possibly decrypt the keys.  It outputs all the keys into a .dat file but also shows the keys as it goes through them in the console window.
https://pastebin.com/Uh5myMxM
I can walk you through what you need to do but it depends on what os you're on.  i would just get a debian live image to run it on to avoid any potential issues.  For some reason on my mac it doesnt actually put the keys into the wallet like it should.   

you just do python pywallet.py --recover --recov_device=*seebelow --recov_size=10Gio (uses french terms for sizes, ctrl+f within the code to see it, look at line 99.  Gio = Gb 1024 Mb Go for 1000Mb etc) --recov_outputdir=./

Like I said i'm happy to walk you through it.  the original pywallet is no longer on github but i think my copy is from somewhere on there, just make sure its the 345kb version not the 60kb version.  you can read through it to know theres no sketchy shit in it. 



Let me know how it goes.  I am almost certain that if its just a typical wallet.dat then the .jar should work.  That tool is a godsend.  It's  only for bitcoin so if you want to do litecoin, you have to convert the WIF key into it's bare hex key then redo the WIF conversion process with a different prefix.


1NQJycjngNzSxxDsoEv5fXEoW5K2qu8rXU if you feel enclined, but no need to.  pm me a means of live chatting.  you will not have to trust me at any point with anything sensitive, please google all instructions i give you to make sure i'm not pulling something.  there are bad people out there.

[MrClones]

hey i've had a lot of experience with recovering keys, I'm almost certain I could help you (as long as it's possible to recover).  Pm me your skype or something and we can have a live chat because it's easier to go back and forth.  At no point will you be at risk and I will source all of my advice from third parties.

I'll do it for free you can donate if you want but i enjoy helping people with things that are super niche like this. 

Before you hit me up, try a couple things. 

I AM REALLY SURE THE FOLLOWING WILL WORK FOR YOU.  It has a gui so no fucking around with command line shit.

https://github.com/prof7bit/wallet-key-tool/releases

I haven't found a better tool for getting keys from many types of wallets.  just run the .jar and load the .dat (make sure to select .dat filetype because it defaults to .wallet for multibit wallets).  It will load in every key (and ask for password if its encrypted). 

seriously i bet it would work with that. 

but pywallet can be weird.  Theres lots of different versions out there and the one i put in the pastebin below is the one that works for me.  put the wallet.dat on a flash drive, find the device name (on windows it would be like D:/ on unix it could be /dev/sda3 on mac /disk/disk2s3) and use pywallet recover.  It scans your storage device byte by byte looking for potential privkeys and you specify any passwords that might possibly decrypt the keys.  It outputs all the keys into a .dat file but also shows the keys as it goes through them in the console window.
https://pastebin.com/Uh5myMxM
I can walk you through what you need to do but it depends on what os you're on.  i would just get a debian live image to run it on to avoid any potential issues.  For some reason on my mac it doesnt actually put the keys into the wallet like it should.   

you just do python pywallet.py --recover --recov_device=*seebelow --recov_size=10Gio (uses french terms for sizes, ctrl+f within the code to see it, look at line 99.  Gio = Gb 1024 Mb Go for 1000Mb etc) --recov_outputdir=./

Like I said i'm happy to walk you through it.  the original pywallet is no longer on github but i think my copy is from somewhere on there, just make sure its the 345kb version not the 60kb version.  you can read through it to know theres no sketchy shit in it. 



Let me know how it goes.  I am almost certain that if its just a typical wallet.dat then the .jar should work.  That tool is a godsend.  It's  only for bitcoin so if you want to do litecoin, you have to convert the WIF key into it's bare hex key then redo the WIF conversion process with a different prefix.


1NQJycjngNzSxxDsoEv5fXEoW5K2qu8rXU if you feel enclined, but no need to.  pm me a means of live chatting.  you will not have to trust me at any point with anything sensitive, please google all instructions i give you to make sure i'm not pulling something.  there are bad people out there.

I have a wallet I am willing to donate someone to help me walk through something I am self teaching linux and all this stuff since I got into crypto.. I am not totally ignorant to this stuff but for some reason every time I try a solution i get to a point where i get stuck or there is a error.. Like finding the private keys in hex editor i searched for the number portion to find the pvtkey right after and I dont know what is the pvt key and what to do next as i get error messages so I am missing something.. Any help would be paid for.

[HCP]

I have a wallet I am willing to donate someone to help me walk through something I am self teaching linux and all this stuff since I got into crypto.. I am not totally ignorant to this stuff but for some reason every time I try a solution i get to a point where i get stuck or there is a error.. Like finding the private keys in hex editor i searched for the number portion to find the pvtkey right after and I dont know what is the pvt key and what to do next as i get error messages so I am missing something.. Any help would be paid for.

What exactly are you attempting to do? recover coins from a corrupted wallet.dat?

PyWallet can be made to work with newer wallet.dat files... it just needs a couple of minor edits to force it to ignore the new metadata in more recent wallet.dat files and run without error and it will dump your private keys. Note that other features of PyWallet still probably won't work properly (like adding, merging etc)

If you don't want to try and edit yourself... I've made the edits and put it on pastebin here: https://pastebin.com/y8p8GZgP

Let me know if you want any help.