wallet.dat (hex code) in 2009

[ABCbits]

I was wondering if it's possible to find the wallet with keys if that wallet was an encrpted?
I have the old drive and forensics shows data but i can't find the wallet with hex and the mentioned sequence. is there a differenet sig for an encrpted wallet? or is it truely lost?

It's possible, tools such as pywallet can do it even if the file is marked as deleted. Most magic bytes applicable for both unencrypted and encrypted wallet. You might want to check few magic bytes/signature at https://bitcoin.stackexchange.com/a/41450.

I may have been decieved or scammed? but this was a first year wallet with the first qt client and had what i think I rememeber was 1000 coins?

By any chance, did you buy wallet.dat file online?

[Hristiyan99]

Hello Everyone,

I am sitting at the same position as the person who initially wrote the post.

I've got an old HDD and I am looking to begin work to recover the wallet.dat files.

I have stopped at R-Studio Forensics software and I am at point of starting deep scan with Known file type.

I have created an image of the disk!

I don't know what signature variations to put at the known file type for the software to scan.

If you have any other suggestions of how to proceed with further software or other idea, I am open to learn.

[Cricktor]

I have created an image of the disk!

Good approach. You create a forensic master image or your storage media, maybe better a second copy of it, too.

You only work on a copy of that master image! Basic idea is to not have to touch old storage media a lot or at all anymore. Any procedure must not alter the forensic master image copy. You should always be able to easily get back to your initial data without risk of data loss if you need to start from fresh.

What do you know about your initial image copy?

Is the filesystem corrupted or OK?

Do you have to deal with deleted files? How much activity was there on the filesystem once important files were deleted or corrupted?

You would need to provide more details about your specific situation to be able to give you better advise on tools to recover wallet files.

[Hristiyan99]

I have created an image of the disk!

Good approach. You create a forensic master image or your storage media, maybe better a second copy of it, too.

You only work on a copy of that master image! Basic idea is to not have to touch old storage media a lot or at all anymore. Any procedure must not alter the forensic master image copy. You should always be able to easily get back to your initial data without risk of data loss if you need to start from fresh.

What do you know about your initial image copy?

Is the filesystem corrupted or OK?

Do you have to deal with deleted files? How much activity was there on the filesystem once important files were deleted or corrupted?

You would need to provide more details about your specific situation to be able to give you better advise on tools to recover wallet files.

Hello,

Thank you for your response!

I have created an Image of the C - directory via DD function from Ubuntu live USB stick.

So far I have determined that there are not any bitcoin traces on the HDD which means that the PC have been re-installed and essentially the HDD formatted.
I would need to begin by searching the HDD for bitcoin software traces to confirm that mining activity has occurred.
Would you suggest to look for traces of Bitcoin software firstly, before looking straight for Wallet.dat file (harder to find)

I am looking for suggestions in software to begin searching for bitcoin software traces.

[Cricktor]

If the current filesystem doesn't contain files that obviously are related to any wallet software, we can assume that either wallet files have been deleted or filesystem has been quick formatted. (I don't know who doesn't do a quick format, unless you want to make sure all data is really wiped.)

If I had to search for deleted files, there are tools to do that. I didn't have to use such tools for a long time, therefore no suggestion, because I usually have multi-generational backups. If I accidently delete something, I can restore such files in the majority of cases from backup. Backups make life so much easier and less stressful.

If you want to search for signatures of private keys, pywallet can do that.

SSD as storage media can have a nasty property which can potentially render file recovery fruitless. Deleted data areas are marked with the TRIM command to the flash controller as areas that can be used for wear leveling. SSDs can behave very differently when you try to read areas that are marked as unused space via TRIM. They can return all zeros, all garbage, sometimes the old data and sometimes something totally different; this is very much device dependent and very much different to HDDs!