Recover private key/coins

[Flue]

It doesn't seem like any of those 19 keys contains any money. Is there a way to recover the other 287 keys?

[Flue]

The recover scan with pywallet on the 2TB drive found 4 possible wallets, 900 encrypted keys (newer wallets) and 1800 possible unencryptet keys. For some reason it only tried to recover the exact same 306 keys like the other scan, from the "recovered-wallet.dat" file, and it stopped at 20/306 this time too. Why didn't it try to recover the other keys? And why does it stop at 20?

[deepceleron]

Thanks for the advice!

I tried running pywallet --recover on just the "recovered-wallet.dat" file. It actually finds 306 keys, but it stops at importing 20/306.

Importing key   20/306:
Traceback (most recent call last):
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 4910, in <
module>
    importprivkey(db, sec, "recovered: %s"%sec, None, True)
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 2622, in i
mportprivkey
    pkey = EC_KEY(str_to_long(sec.decode('hex')))
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 1056, in _
_init__
    self.pubkey = Public_key( generator, generator * secret )
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 1000, in _
_init__
    raise RuntimeError, "Generator point has x or y out of range."
RuntimeError: Generator point has x or y out of range.

The dat file with only 19 keys actually works loading with the bitcoin client. Is there anyway to check if it contains any money without having to sync the bitcoin client?

It doesn't just "stop" importing, it has a catastrophic failure with the value of one key being invalid as a elliptical curve private key. Likely there was a KeyA or other data prefix surrounding an area of a hard drive that made it look like a potential key, but the data was all 00s or all FFs, which would cause this error. Either the key will need to be edited out of the recovered-wallet, by hex editing the wallet to make that particular data a real (but no money) key, or fixing pywallet so it evaluates and skips invalid private keys.

[deepceleron]

I'm fixing pywallet, but it is indented with tabs,  . http://www.python.org/dev/peps/pep-0008/#tabs-or-spaces

[Flue]

Thanks alot! I really appreciate it!

I get a syntax error at line 4261, "table in =", an arrow is pointing at the "=". Typo?

[deepceleron]

Thanks alot! I really appreciate it!

I get a syntax error at line 4261, "table in =", an arrow is pointing at the "=". Typo?

Ooops, looks like I randomly hit "enter" in the middle of the file, fixed and reupped. I also ran it thru a code validator which removed some imports and reformatted the python.

[Flue]

Now I get this error:

Traceback (most recent call last):
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 27, in <mo
dule>
    pyw_filename = os.path.basename(__file__)
NameError: name 'os' is not defined

[deepceleron]

Now I get this error:

Traceback (most recent call last):
  File "C:\Users\Name\AppData\Roaming\Bitcoin\pywallet.py", line 27, in <mo
dule>
    pyw_filename = os.path.basename(__file__)
NameError: name 'os' is not defined

The code (in)validator appears to have removed the os,sys import. Grr, I guess I'll just text-edit the python to patch it, and keep the tabs instead of using my IDE which bitches about the tabs and won't even let me type them. Sorry about all that...

[deepceleron]

Ok, reupped, after actually running the code and recovering some real keys off my own hard drive:

Code:

C:\pywallet>diff.exe pywallet.py pywallet-keyskip.py
4910,4911c4910,4919
<                       importprivkey(db, sec, "recovered: %s"%sec, None, True)
<                       importprivkey(db, sec+'01', "recovered: %s"%sec, None, True)
---
>                       try:
>                               importprivkey(db, sec, "recovered: %s"%sec, None, True)
>                       except RuntimeError, e:
>                               print "%s error importing key %s" % (e, sec)
>                               continue
>                       try:
>                               importprivkey(db, sec+'01', "recovered: %s"%sec, None, True)
>                       except RuntimeError, e:
>                               print "%s error importing key %s" % (e, sec)
>                               continue

[Flue]

Sure you reuploaded the right code? I get the same error with that one

[deepceleron]

Sure you reuploaded the right code? I get the same error with that one

Yup, I renamed it just in case your browser is caching the old version or something:
http://we.lovebitco.in/pywallet-keyskip2.py

I modified this version of pywallet:
https://github.com/jackjack-jj/pywallet/blob/master/pywallet.py

[Flue]

Now I've ran into a new problem which happens with both the new and the old version of pywallet. Sometimes it scannes the "recovered-wallet.dat" file, and actually tries to recover the keys to a new files, but most of the times it just skips everything without an error message:

Code:

Read 2.1 Go in 0.6 minutes

Found 0 possible wallets
Found 0 possible encrypted keys
Found 490 possible unencrypted keys


All the found encrypted private keys have been decrypted.
The wallet is encrypted and the passphrase is correct


Importing:


The new wallet H:\recover/recovered_wallet_1384452226.dat contains the 0 recove
red key

C:\Users\Name\AppData\Roaming\Bitcoin>

Any idea? Am I doing something wrong?

[deepceleron]

Any idea? Am I doing something wrong?

I have no explanation; maybe move your original found-key file to a simple directory name such as C:\WALLET along with the script, specify the max size, etc. Here is the command line I just used with pywallet in the same directory as the keyfile:

pywallet-keyskip2.py --recover --recov_device recovered-wallet.dat --recov_size 1Mio --recov_outputdir .

[Flue]

Yay! Managed to import all the keys now. Had to first do a normal --dumpwallet on the file, then run the --recover command. It probably reads from the text file instead of the wallet.

"The new wallet ./recovered_wallet_1384453446.dat contains the 306 recovered keys"

Which way is the fastest to check the balance?

Do I have to resync the bitcoin program to check balance, or just use the new wallet?

[DannyHamilton]

Yay! Managed to import all the keys now. Had to first do a normal --dumpwallet on the file, then run the --recover command. It probably reads from the text file instead of the wallet.

"The new wallet ./recovered_wallet_1384453446.dat contains the 306 recovered keys"

Which way is the fastest to check the balance?

Do I have to resync the bitcoin program to check balance, or just use the new wallet?

Your wallet will need to do a rescan, but not a resync.  As long as your blockchain is already caught up, you won't have to download/synchronize it again.  You'll just have to wait for the client to scan through the blockchain that you already have so it can find any unspent outputs associated with those private keys.

[Flue]

Bitcoin-QT freezes when I try to run it with the -rescan command...

[Flue]

It worked now. Some old transactions came up, but they are from a newer wallet. Looks like I have to run another 10 hour scan on my 2TB drive. Thanks for the help so far!

[deepceleron]

Bitcoin-QT freezes when I try to run it with the -rescan command...

It takes a long time to run, it can look like it locked up since there is no progress bar or such.
You can also start Bitcoin-Qt with the -salvagewallet option just for another round of validation.

[Flue]

After a full scan it found 4 wallets, 900 encryptet keys and 1800 unencrypted keys. It only imported those 306 keys from last time. 0 coins. Guess my coins are lost forever.

I made 4 or 5 backups back then. But I forgot about bitcoin for a while because of the low value, and one disk after another failed. I'm even pretty sure I made an online backup, but I can't find it anywhere...

Thanks for all the help though!

[tom_o]

After a full scan it found 4 wallets, 900 encryptet keys and 1800 unencrypted keys. It only imported those 306 keys from last time. 0 coins. Guess my coins are lost forever.

I made 4 or 5 backups back then. But I forgot about bitcoin for a while because of the low value, and one disk after another failed. I'm even pretty sure I made an online backup, but I can't find it anywhere...

Thanks for all the help though!

Contact http://www.datagenetics.com/ and offer them a portion of the hoard if they manage to open it?

Since 'change' privkeys are generated based on a sequential seed iirc, you might be able to get into others other using those and a smaller amount of bruteforcing, if not they may be able to take the wallet apart and avoid the corrupted areas crashing bitcoin-qt. Worth an email at least eh?

I sent them a random one just to tell them about bitcoin the other day, they might be interested.


Check out their blog for some of their pretty amazing work, and some comedy including this.