Recover private key/coins

[Flue]

Hello!

I managed to format the hard drive with my wallet.dat file a long time ago. I quickly realized what had happend and tried to recover the file. I had written some few files to the drive after formatting it, but the drive is 2TB so I had my hopes up that I didn't overwrite the wallet.dat itself. I managed to recover 2 different wallet.dat files with a file recovery program. The program said both files were in great shape. Programs and movies recovered at the same time worked perfectly. I never managed to get the 2 wallet.dat files working...

When I didn't get them to work I ran a linux program from this forum which scanned the drive after keys and rebuilt a "recovered-wallet.dat" file. I didn't manage to get this one working either.

Back then the 10 coin's I had weren't worth too much so I quickly gave up, but now the coin's are worth almost 4000$!

So far I've tried to use pywallet and dump my private keys.

When I use the --dumpwallet command on the first 2 files I get the error message: ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.

When using the same command on the "recovered-wallet.dat" file I get the error message:

Code:

 C:\Users\name\AppData\Roaming\Bitcoin>pywallet.py --dumpwallet > TEXT.txt
WARNING:root:pycrypto or libssl not found, decryption may be slow
Traceback (most recent call last):
  File "C:\Users\name\AppData\Roaming\Bitcoin\pywallet.py", line 2108, in p
arse_wallet
    d.update(parse_BlockLocator(vds))
TypeError: 'NoneType' object is not iterable

Can anyone help?

[Marinowner]

do you know your bitcoin address , if you do we  can try to get private key!

[CrypticBits]

I've sent you a PM mate, I've had about the same problem.

[El_Happy]

With bitcoin-qt is just need to closed, then backup the wallet.dat and change of the restored file wallet.dat and start again with the command option -rescan.

In command window type bitcoin-qt.exe -rescan and hit enter.

[pontiacg5]

I can't help, but please be careful which who you choose to help. You seem pretty knowledgeable, so I'm sure you know why.

Good luck getting your coins back!

[Flue]

Thanks for answering!

do you know your bitcoin address , if you do we  can try to get private key!

My bitcoin adress is: 13HeWt9mSkP6S6kMUzQu9pxh5bVazdw2sm

With bitcoin-qt is just need to closed, then backup the wallet.dat and change of the restored file wallet.dat and start again with the command option -rescan.

In command window type bitcoin-qt.exe -rescan and hit enter.

Running rescan with the "recovered.wallet.dat" file atleast makes bitcoin try to load. After some seconds of loading it gives me a message in my native language that says "Error loading wallet.dat. The wallet is damaged".

If I run the same command with the other files it doesn't even begin to load, and gives the error "wallet.dat corrupt, salvage failed" (in english).

I can't help, but please be careful which who you choose to help. You seem pretty knowledgeable, so I'm sure you know why.

Good luck getting your coins back!

Thanks for the warning! I will be careful. Already got one suspect PM

[Wipeout2097]

There is someone very reputable in this forum that may be able to help you technically, and to whom you can trust. I believe that is DannyHamilton ...

[Flue]

There is someone very reputable in this forum that may be able to help you technically, and to whom you can trust. I believe that is DannyHamilton ...

Thank you! I've sent him a PM

[DannyHamilton]

There is someone very reputable in this forum that may be able to help you technically, and to whom you can trust. I believe that is DannyHamilton ...

Thanks for the vote of confidence.  Unfortunately, this sort of wallet damage really isn't something I've got the proper skills to help with. I've been meaning to dig more into the actual structure of the wallet.dat file and learn how to parse it, but I just haven't had time for that yet. You could try asking jackjack.  He's the guy who created and maintains pywallet.

I wouldn't give up hope yet.  It might still be possible to extract private keys from a significantly damaged wallet.dat file.

It might also be possible to extract a partial/damaged private key.  If there are only a handful of bits damaged or missing, a brute-force approach to repair/replace the damaged/missing parts might also be possible.

[Flue]

Thanks alot! I will ask jackjack

[Jutarul]

First look for evidence on the hard drive.

Also read this thread. https://bitcointalk.org/index.php?topic=91702.msg1016998#msg1016998

[Flue]

First look for evidence on the hard drive.

Also read this thread. https://bitcointalk.org/index.php?topic=91702.msg1016998#msg1016998

Pubkey is the same as the bitcoin adress (the one you send bitcoins to)?

I'm gonna try to do a scan, but I fear it's long gone. The drive has been used alot the last year (after I recovered those other files). I acutally have a private key scan with pywallet already going, though I'm pretty sure everything there is overwritten...

I suggest you remove the "1BTC reward!" from your status.

Those with the skills to actually help you will do so simply because they can, and they like to help.

As you can see from the post above, offering a reward will only attract a LOT of random people who have no idea what your problem is or how to fix it.  They'll pop in here, barely even read what you've posted and then spout off with some random piece of advice they think they've heard someone else offer in the past, hoping that the right answer will be similar enough to what they've said that they can claim they deserve a part of the reward.  Your thread will fill up with useless, senseless, unhelpful confusion and it will become difficult to tell who is offering actual advice and help, and who is likely to waste your time.

If your problem is eventually resolved successfully, you can always still offer to make a donation to the person or people that you feel helped you as a way of saying thanks.

Done

[DannyHamilton]

Thanks alot! I will ask jackjack

If he can't help or is too busy to respond at the moment, you could also see if deepceleron has the right skills to help.  He's knowledgeable, and usually willing to help out if he can.

[Flue]

Thanks alot! I will ask jackjack

If he can't help or is too busy to respond at the moment, you could also see if deepceleron has the right skills to help.  He's knowledgeable, and usually willing to help out if he can.

Asked both of them now. Awaiting response

[Jutarul]

I managed to format the hard drive with my wallet.dat file a long time ago.

First look for evidence on the hard drive.

1. It needs to be confirmed whether the restored wallet.dat files actually are the ones which contain the private keys for the claimed address.
2. If 1) fails, it needs to be confirmed that the claimed address is somewhere on the hard drive.

Such a confirmation was missing from the description. There are multiple reasons why the claimed address may not be in the restored wallet files or on the hard drive at all - if so the OP may actually be trying to restore a useless wallet.dat file. The script I referenced works with hard drives and files in the same way. After there is a positive confirm, then you can start thinking about data recovery.

[deepceleron]

Asked both of them now. Awaiting response

The second that you say the word "format" or "repartition", the only hope is to yank the drive from service and scan the whole surface for any recoverable private keys. Data likely will no longer be where it should be, recovery software will find junk in the sectors where "wallet.dat" is indicated to have been.

After IMMEDIATELY discontinuing use of any drive with possibly-recoverable bitcoins on it, you need to boot another operating system off another drive, and use software that will mount and scan the entire original drive by raw disk sector to discover any recoverable private key data that could be left on the drive.

Get a second hard drive to run off of or bootable USB with a linux distro on it, and get pywallet running on it: https://bitcointalk.org/index.php?topic=34028.0

Then use the command below, pointed to the appropriate device corresponding to the old hard drive and the correct drive size/area to scan, pywallet will go through these steps: 1. read every byte on the disk to look for keys 2. create a recovery file of private keys which enables 3. attempt recovery of password-encrypted keys using possible phrases

python pywallet.py --recover --recov_device /dev/sdb --recov_size 120GB --recov_outputdir ~/foundkeys

It takes about 10 hours to fully 0-wipe a 2TB hard drive, expect longer for key recovery just to read and process the whole drive.

Several threads are around discussing this, but there is not one that is at "master tutorial" level.

[Flue]

Asked both of them now. Awaiting response

The second that you say the word "format" or "repartition", the only hope is to yank the drive from service and scan the whole surface for any recoverable private keys. Data likely will no longer be where it should be, recovery software will find junk in the sectors where "wallet.dat" is indicated to have been.

After IMMEDIATELY discontinuing use of any drive with possibly-recoverable bitcoins on it, you need to boot another operating system off another drive, and use software that will mount and scan the entire original drive by raw disk sector to discover any recoverable private key data that could be left on the drive.

Get a second hard drive to run off of or bootable USB with a linux distro on it, and get pywallet running on it: https://bitcointalk.org/index.php?topic=34028.0

Then use the command below, pointed to the appropriate device corresponding to the old hard drive and the correct drive size/area to scan, pywallet will go through these steps: 1. read every byte on the disk to look for keys 2. create a recovery file of private keys which enables 3. attempt recovery of password-encrypted keys using possible phrases

python pywallet.py --recover --recov_device /dev/sdb --recov_size 120GB --recov_outputdir ~/foundkeys

Several threads are around discussing this, but there is not one that is at "master tutorial" level.

Thanks alot for answering!

This is exactly what I'm already doing. It's about half way through scanning the drive. I will post results when it's done. About 1TB left.

I used this tool: https://bitcointalk.org/index.php?topic=25091.0 to recover the "recovered-wallet.dat" file right after the disk was formated. Does this mean that the file MIGHT contain the right information?

[cr1776]

Whatever you do, keep copies of the recovered wallet.dat files indefinitely.  Just because you can't get it now (unless you end up being able to), doesn't mean you might not be able to do so in the future.

For example, depending upon what has been recovered from each, you MIGHT be able to combine the two into a working one.  Likewise, you might be able to recover part of your private key (or even all of it) eventually.  Or, tools may improve.  Either way, if you are not able to successfully recover something now, doesn't mean you won't be able to do so in the future.

The suggestion of talk to jackjack is a good one as is being careful about who you send information to.

There is someone very reputable in this forum that may be able to help you technically, and to whom you can trust. I believe that is DannyHamilton ...

Thanks for the vote of confidence.  Unfortunately, this sort of wallet damage really isn't something I've got the proper skills to help with. I've been meaning to dig more into the actual structure of the wallet.dat file and learn how to parse it, but I just haven't had time for that yet. You could try asking jackjack.  He's the guy who created and maintains pywallet.

I wouldn't give up hope yet.  It might still be possible to extract private keys from a significantly damaged wallet.dat file.

It might also be possible to extract a partial/damaged private key.  If there are only a handful of bits damaged or missing, a brute-force approach to repair/replace the damaged/missing parts might also be possible.

[Flue]

Whatever you do, keep copies of the recovered wallet.dat files indefinitely.  Just because you can't get it now (unless you end up being able to), doesn't mean you might not be able to do so in the future.

For example, depending upon what has been recovered from each, you MIGHT be able to combine the two into a working one.  Likewise, you might be able to recover part of your private key (or even all of it) eventually.  Or, tools may improve.  Either way, if you are not able to successfully recover something now, doesn't mean you won't be able to do so in the future.

The suggestion of talk to jackjack is a good one as is being careful about who you send information to.

Thanks for the advice!

I tried running pywallet --recover on just the "recovered-wallet.dat" file. It actually finds 306 keys, but it stops at importing 20/306.

Code:

Importing key   20/306:
Traceback (most recent call last):
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 4910, in <
module>
    importprivkey(db, sec, "recovered: %s"%sec, None, True)
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 2622, in i
mportprivkey
    pkey = EC_KEY(str_to_long(sec.decode('hex')))
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 1056, in _
_init__
    self.pubkey = Public_key( generator, generator * secret )
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 1000, in _
_init__
    raise RuntimeError, "Generator point has x or y out of range."
RuntimeError: Generator point has x or y out of range.

The dat file with only 19 keys actually works loading with the bitcoin client. Is there anyway to check if it contains any money without having to sync the bitcoin client?

[DeathAndTaxes]

The dat file with only 19 keys actually works loading with the bitcoin client. Is there anyway to check if it contains any money without having to sync the bitcoin client?

You could export those private keys.  I can't remember if pywallet will export the address along with private key but if it doesn't you could use something like bitcoinaddress (offline) to generate the address from those private keys.  Then just check the balance of the 19 addresses on a site like blockchain.info.