Please help find missing bitcoin

[mforno]

Hi,

I have a friend who bought bitcoin in 2009 but cant remember much at all.
On his laptop there is a bitcoin folder but it is dated 2018 for when the wallet.dat was created which leads me to believe that it was made this year.
HOWEVER

When I go into the debug text file in the folder some of the info reads like this:
2018-05-12 02:14:32 UpdateTip: new best=00000000839a8e6886ab5951d76f411475428afc90947ee320161bbf18eb6048 height=1 version=0x00000001 log2_work=33.000022 tx=2 date='2009-01-09 02:54:25' progress=0.000000 cache=0.0MiB(1txo)
2018-05-12 02:14:32 UpdateTip: new best=000000006a625f06636b8bb6ac7b960a8d03705d1ace08b1a19da3fdcc99ddbd height=2 version=0x00000001 log2_work=33.584985 tx=3 date='2009-01-09 02:55:44' progress=0.000000 cache=0.0MiB(2txo)
2018-05-12 02:14:32 UpdateTip: new best=0000000082b5015589a3fdf2d4baff403e6f0be035a5d9742c1cae6295464449 height=3 version=0x00000001 log2_work=34.000022 tx=4 date='2009-01-09 03:02:53' progress=0.000000 cache=0.0MiB(3txo)
2018-05-12 02:14:32 UpdateTip: new best=000000004ebadb55ee9096c9a2f8880e09da59c0d68b1c228da88e48844a1485 height=4 version=0x00000001 log2_work=34.32195 tx=5 date='2009-01-09 03:16:28' progress=0.000000 cache=0.0MiB(4txo)
2018-05-12 02:14:32 UpdateTip: new best=000000009b7262315dbf071787ad3656097b892abffd1f95a1a022f896f533fc height=5 version=0x00000001 log2_work=34.584985 tx=6 date='2009-01-09 03:23:48' progress=0.000000 cache=0.0MiB(5txo)
2018-05-12 02:14:33 UpdateTip: new best=000000003031a0e73735690c5a1ff2a4be82553b2a12b776fbd3a215dc8f778d height=6 version=0x00000001 log2_work=34.807377 tx=7 date='2009-01-09 03:29:49' progress=0.000000 cache=0.0MiB(6txo)
2018-05-12 02:14:33 UpdateTip: new best=0000000071966c2b1d065fd446b1e485b2c9d9594acd2007ccbd5441cfc89444 height=7 version=0x00000001 log2_work=35.000022 tx=8 date='2009-01-09 03:39:29' progress=0.000000 cache=0.0MiB(7txo)
2018-05-12 02:14:33 UpdateTip: new best=00000000408c48f847aa786c2268fc3e6ec2af68e8468a34a28c61b7f1de0dc6 height=8 version=0x00000001 log2_work=35.169947 tx=9 date='2009-01-09 03:45:43' progress=0.000000 cache=0.0MiB(8txo)
2018-05-12 02:14:33 UpdateTip: new best=000000008d9dc510f23c2657fc4f67bea30078cc05a90eb89e84cc475c080805 height=9 version=0x00000001 log2_work=35.32195 tx=10 date='2009-01-09 03:54:39' progress=0.000000 cache=0.0MiB(9txo)


At the end of each paragraph it shows the date of 2009, could this mean something?



I have the wallet.dat but when I downloaded the Bitcoin Core wallet onto my computer and synched it and the replaced the wallet.dat with his one it shows 0. Am I doing something wrong or missing something?

[1713858495]

1713858495

[1713858495]

1713858495

[1713858495]

1713858495

[1713858495]

1713858495

[vit05]

He bought or he mined? This file could be related to Bitcoin Core wallet and as it downloads the whole blockchain it shows historical blocks.

[mforno]

The debug file only contains info of each blocks, starting from genesis block. New best is block hash, date is timestamp of when the block is mined (and thus no correlation with your problem) and others already tell itself.
If you have original wallet.dat (not new/the result of overwritten), we might able to dig more information.

I do have the wallet.dat
Im not sure whether it is an old or new one. How can I tell?
All I know is when I open the debug info I get all that info.

He bought or he mined? This file could be related to Bitcoin Core wallet and as it downloads the whole blockchain it shows historical blocks.

The story goes he bought bitcoin back in 2009.
He may have mined it by accident? Im not so sure. But he is certain he bought bitcoin back then.

[mforno]

The debug file only contains info of each blocks, starting from genesis block. New best is block hash, date is timestamp of when the block is mined (and thus no correlation with your problem) and others already tell itself.
If you have original wallet.dat (not new/the result of overwritten), we might able to dig more information.

I do have the wallet.dat
Im not sure whether it is an old or new one. How can I tell?
All I know is when I open the debug info I get all that info.

Check the date created or date modified of the wallet.dat on your file explorer. But date created usually changed if the wallet.dat is copied.

He bought or he mined? This file could be related to Bitcoin Core wallet and as it downloads the whole blockchain it shows historical blocks.

The story goes he bought bitcoin back in 2009.
He may have mined it by accident? Im not so sure. But he is certain he bought bitcoin back then.

I doubt he mistaken between mining/buying bitcoin (unless his memory is wrong). But anyway this information can't help much.

A bit off-topic, the first bitcoin exchange is New Liberty Standard (https://web.archive.org/web/20091229132610/http://newlibertystandard.wetpaint.com/page/Exchange+Rate). You might want ask him if he know/remember this exchange.

So what the time stamps, could that mean that he once was mining it and didnt even realise it? or running a node?
I will ask him about the Liberty Exchange and see if that sparks his memory. Thanks for that!

[nc50lc]

Bought Bitcoin in the year 2009, doesn't seem right.

So what the time stamps, could that mean that he once was mining it and didnt even realise it? or running a node?
I will ask him about the Liberty Exchange and see if that sparks his memory. Thanks for that!

Here's to rephrase the answer: Your given debug log in the OP only consists of information regarding full nodes, nothing on wallets or whatsoever.
It was used by the client, though.

I have a friend who bought bitcoin in 2009 but cant remember much at all.
On his laptop there is a bitcoin folder but it is dated 2018 for when the wallet.dat was created which leads me to believe that it was made this year.

The datestamp 2018 indicates that something inside that folder was overwritten/added on the displayed date.
In your case, that was the time when you've overwritten the original wallet.dat inside that data directory.

If you still got a backup of the directory, there's still a chance to check if the wallet has bitcoins in it.
Otherwise, stop using the client until you can get a data-recovery software to recover the old (overwritten) wallet.dat to increase the chance of data recovery success (talking about the file, not the coins in it).

[mforno]

Bought Bitcoin in the year 2009, doesn't seem right.

So what the time stamps, could that mean that he once was mining it and didnt even realise it? or running a node?
I will ask him about the Liberty Exchange and see if that sparks his memory. Thanks for that!

Here's to rephrase the answer: Your given debug log in the OP only consists of information regarding full nodes, nothing on wallets or whatsoever.
It was used by the client, though.

I have a friend who bought bitcoin in 2009 but cant remember much at all.
On his laptop there is a bitcoin folder but it is dated 2018 for when the wallet.dat was created which leads me to believe that it was made this year.

The datestamp 2018 indicates that something inside that folder was overwritten/added on the displayed date.
In your case, that was the time when you've overwritten the original wallet.dat inside that data directory.

If you still got a backup of the directory, there's still a chance to check if the wallet has bitcoins in it.
Otherwise, stop using the client until you can get a data-recovery software to recover the old (overwritten) wallet.dat to increase the chance of data recovery success (talking about the file, not the coins in it).

Oh dear, so if the wallet.dat has been overwritten then is there anyway of going back in time before that has happenned?
I am having trouble looking for old backups. Is there software out that can bring a file back that has been overwritten?

Thank's for clarifying about the timestamps.

So it was this year someone or my friend has installed the bitcoin core and happenned to overwrite the wallet.dat file by accident presumably.

[mforno]

I installed Recuva software and searched the recycle bin.
What I found was a file called $R1R1T1P.exe it was last modified 02/05/2013 its 14,691kb and its file name is blk00013.dat and was stored in users\henry\appdata\roaming\bitcoin\blocks\blk00013.dat

What could this file suggest?
Was this part of a mining file? node? So weird.

[nc50lc]

What could this file suggest?
Was this part of a mining file? node? So weird.

Its just a blk.dat file (and it's quite large wasn't it?), it consists of blocks that's required by the client to verify transactions.

What you want to find is something named like "wallet.dat" or any ".dat" that is not larger than 10mb unless it was used a lot of times (in some cases).
Also, it shouldn't be in "blocks" folder.
My two cents is that if you happen to successfully recover the wallet file, it might be already corrupted and produce some issues.
Make sure to make a backup copy this time before trying to use a private key recovery software on it.

[Thirdspace]

I do have the wallet.dat
Im not sure whether it is an old or new one. How can I tell?

can you try dumpwallet command on console and then check the output file
in that file, each line will show the date when the specific address was generated by the wallet
it should give you some clues on how old the wallet you currently have

[mforno]

I do have the wallet.dat
Im not sure whether it is an old or new one. How can I tell?

can you try dumpwallet command on console and then check the output file
in that file, each line will show the date when the specific address was generated by the wallet
it should give you some clues on how old the wallet you currently have

When I typed in "dumpwallet" where does the file save to? or how do I see the information you are talking about?

Cheers

[Thirdspace]

When I typed in "dumpwallet" where does the file save to? or how do I see the information you are talking about?

for example on console you can type: dumpwallet privkeys.txt
and the output file privkeys.txt will be saved in the same directory of your wallet.dat
then just open the text file normally,
in each line, after private key it shows the date when that specific address was created
though I'm not sure whether the date info is accurate for older wallet like yours

[Abdussamad]

The 2009 in the debug log is the timestamp of the block bitcoin core has downloaded from the p2p network. That's what it does when you run it. It downloads the entire transaction history of the bitcoin network from inception. It has nothing to do with the age of the wallet or whether your friend was a miner or not.