I need Help finding or recovering bitcoins off an old hard drive

[ajohnson375]

About four years ago, I bought my friend some donuts. He downloaded the bitcoin wallet app on my amazon blu phone and gave me $10 worth of bitcoin instead of cash. Since then I have switched over to an iphone, and completely forgot about my bitcoin account until recently. Is there a way to recover my bitcoin account? I know nothing about anything.

[Stedsm]

About four years ago, I bought my friend some donuts. He downloaded the bitcoin wallet app on my amazon blu phone and gave me $10 worth of bitcoin instead of cash. Since then I have switched over to an iphone, and completely forgot about my bitcoin account until recently. Is there a way to recover my bitcoin account? I know nothing about anything.

Do you have the wallet file saved with yourself anywhere?
Do you have the phrase / seed saved with you? Which wallet was that exactly? Did he put any password to protect the wallet? If yes, do you know it?

And there's nothing such a Bitcoin account, but Bitcoin wallets and addresses.

[keychainX]

About four years ago, I bought my friend some donuts. He downloaded the bitcoin wallet app on my amazon blu phone and gave me $10 worth of bitcoin instead of cash. Since then I have switched over to an iphone, and completely forgot about my bitcoin account until recently. Is there a way to recover my bitcoin account? I know nothing about anything.

If you still have your phone, then yes you can.

/KX

[SheriffBass]

About four years ago, I bought my friend some donuts. He downloaded the bitcoin wallet app on my amazon blu phone and gave me $10 worth of bitcoin instead of cash. Since then I have switched over to an iphone, and completely forgot about my bitcoin account until recently. Is there a way to recover my bitcoin account? I know nothing about anything.

Do you have the wallet file saved with yourself anywhere?
Do you have the phrase / seed saved with you? Which wallet was that exactly? Did he put any password to protect the wallet? If yes, do you know it?

And there's nothing such a Bitcoin account, but Bitcoin wallets and addresses.

Hello There,

    to avoid confusion, would you please start your own thread discussing your potential lost wallet circumstances!

Thank you and good luck.

[almightyruler]

OP: is 1HT7xU2Ngenf7D4yocz2SAcnNLW7rK8d4E your address? It was first funded in 2011, but it's also had some substantial amounts sent to it more recently (nearly $15k USD last year), which doesn't really fit your story.

Any luck recovering the funds yet?

[SheriffBass]

OP: is 1HT7xU2Ngenf7D4yocz2SAcnNLW7rK8d4E your address? It was first funded in 2011, but it's also had some substantial amounts sent to it more recently (nearly $15k USD last year), which doesn't really fit your story.

Any luck recovering the funds yet?

No, no luck!!
no wallets no keys :-(
Have to scan a couple of flash drives ( one is totally dead) then read every shred of paper in my place just in case if I have any hints written/ printed. that address u mentioned Looks like it's every ones ghost address: https://bitcointalk.org/index.php?topic=1225430.0

someone said I should still scan the empty potential wallets ( 2 potential wallets found with 0 keys) not sure how good of advice this is?(maybe the program missed a key) I don't quite get it, no keys is no money/ coins right?? so why bother scan against the block chain??

[SheriffBass]

I did that, and It’s asking me to enter the passphrase for the wallet that will contain all the recovered keys, so do I make it up, generate it through a website, Or just ignore it/ bypass it for now??

You can either try to leave it blank or set it to something that you will remember (there is no need to use an external website for that). If I were you, I would set the passphrase just to be sure it worked fine. You will need it to open the wallet if the recovery turns out to be successful.

   So if I got to scan quite a few hard drives, and ended up with a few partial recovered wallets, or potential wallets how can I open them??
I don't know what program to use to open the wallets/ partial recovered wallets......)
I downloaded the whole blockchain on a fresh PC and wondering if I can open them or plug them into the block chain to see if they are viable!!

when I clicked export transactions from bitcoin core it created a .csv file. how can i read its content and can i reverse it ( import to the wallet/ bitcoin core) from a potential previously created wallet?

[HCP]

So if I got to scan quite a few hard drives, and ended up with a few partial recovered wallets, or potential wallets how can I open them??
I don't know what program to use to open the wallets/ partial recovered wallets......)
I downloaded the whole blockchain on a fresh PC and wondering if I can open them or plug them into the block chain to see if they are viable!!

If you have recovered "wallet.dat" files... just open them with a fully sync Bitcoin Core... You can either shutdown Bitcoin Core, switch "wallet.dat" in datadir, restart Bitcoin Core... or you can shutdown Bitcoin Core and start it from the commandline specifying which wallet file to read using the -wallet option:

...
-wallet=<path>

Specify wallet database path. Can be specified multiple times to load multiple wallets. Path is interpreted relative to <walletdir> if it is not absolute, and will be created if it does not exist (as a directory containing a wallet.dat file and log files). For backwards compatibility this will also accept names of existing data files in <walletdir>.)
...

So you could even try and load all of them at once, assuming you're using one of the newer "multi-wallet" capable versions.

when I clicked export transactions from bitcoin core it created a .csv file. how can i read its content and can i reverse it ( import to the wallet/ bitcoin core) from a potential previously created wallet?

A ".csv" file is simply text file in "comma separate values" format... You should be able to open it in any text editor to review the contents. Also, any spreadsheet app like Excel should be able to open it as well (and possibly make it slightly easier to read)

Even if you could import it back into Bitcoin Core (note: you can't), it wouldn't be much of much use in attempting to recover any funds... it's simply a list of transaction data (ie. transactionIDs and amounts etc)... it won't contain any private keys or anything like that.

[BASE16]

it wouldn't be much of much use in attempting to recover any funds... it's simply a list of transaction data (ie. transactionIDs and amounts etc)... it won't contain any private keys or anything like that.

This depends if that csv file was made in electrum somewhere in the past, you better not trash it because it will contain all of your private key's.



Also you can import them in Electrum.
So if unsure about old data and the way it was generated, it's always better to keep all options open.

[SheriffBass]

So r u saying that if I download Electrum it would be easier to open these files created by PYwallet (Jack Jack)?
is it a simple copy and paste or drag and drop?
 or do I have to know coding, programming, or how to use CMD?

[bob123]

So r u saying that if I download Electrum it would be easier to open these files created by PYwallet (Jack Jack)?
is it a simple copy and paste or drag and drop?
 or do I have to know coding, programming, or how to use CMD?

Please check HCP's post:

A ".csv" file is simply text file in "comma separate values" format... You should be able to open it in any text editor to review the contents. [...]

And especially this:

Even if you could import it back into Bitcoin Core (note: you can't), it wouldn't be much of much use in attempting to recover any funds... it's simply a list of transaction data (ie. transactionIDs and amounts etc)... it won't contain any private keys or anything like that.

You need your private keys to spend any coins.
The transaction data simply does not contain this information. And it won't help you "recovering" it. Unfortunately it won't help you recovering any funds at all.

[HCP]

This depends if that csv file was made in electrum somewhere in the past, you better not trash it because it will contain all of your private key's.

Did you read the quote in my post?

when I clicked export transactions from bitcoin core it created a .csv file.

It's NOT a .csv from Electrum... it's a .csv exported from Bitcoin Core... it's pretty much useless as far as wallet/coin recovery is concerned.

Also you can import them in Electrum.

So, no... he can't import them in Electrum... because it's not a file full of private keys

So r u saying that if I download Electrum it would be easier to open these files created by PYwallet (Jack Jack)?

No. Pywallet creates wallet.dat's in the BerkeleyDB format that Bitcoin Core uses. These files are NOT compatible with Electrum. Electrum uses an entirely different wallet file format (JSON text with optional encryption).

[BASE16]

This depends if that csv file was made in electrum somewhere in the past, you better not trash it because it will contain all of your private key's.

Did you read the quote in my post?

when I clicked export transactions from bitcoin core it created a .csv file.

It's NOT a .csv from Electrum... it's a .csv exported from Bitcoin Core... it's pretty much useless as far as wallet/coin recovery is concerned.

Also you can import them in Electrum.

So, no... he can't import them in Electrum... because it's not a file full of private keys

So r u saying that if I download Electrum it would be easier to open these files created by PYwallet (Jack Jack)?

No. Pywallet creates wallet.dat's in the BerkeleyDB format that Bitcoin Core uses. These files are NOT compatible with Electrum. Electrum uses an entirely different wallet file format (JSON text with optional encryption).

I know from experience that when dealing with older data, you can never assume anything, you have to do analysis without making any assumptions.
Many people told me yes they made it in this or that application and when i scanned the drives it turned out it was a completely different story and in some cases even a different coin or a completely different password not containing even one word they was sure it contained.

The right approach is to analyze everything, regardless of what the customer claims.
 

[bob123]

I know from experience that when dealing with older data, you can never assume anything, you have to do analysis without making any assumptions.
[...]
The right approach is to analyze everything, regardless of what the customer claims.

If you never assume anything and do stuff without making any assumptions, you will never succeed in anything.

It is publicly known how wallets worked in the past and how they work now.
And a CSV export of transaction data does not contain any sensitive information (i.e. private keys). So it is pointless.

You are free to "not assume anything" and waste your time, but it won't help OP.

[BASE16]

If you never assume anything and do stuff without making any assumptions, you will never succeed in anything.

I also know from experience that this statement is not true.
I succeeded in many things, because i worked with what i had in stead of making assumptions.
Logic is simple it's either true or false.
There is no room for assumptions.

About helping the OP , do you think it helps to advise him to start deleting things ?

[HCP]

About helping the OP , do you think it helps to advise him to start deleting things ?

At what point did anyone in this thread advise the OP to delete anything?

OP was advised that they could simply open the file with a text editor (or spreadsheet) and see what was in it... but any Transaction export from Bitcoin Core would not contain any private keys and would be of very little value in coin/wallet recovery (at best, you'd get a list of addresses that you could view on a block explorer to see if they held any coins)

[BASE16]

About helping the OP , do you think it helps to advise him to start deleting things ?

At what point did anyone in this thread advise the OP to delete anything?

OP was advised that they could simply open the file with a text editor (or spreadsheet) and see what was in it... but any Transaction export from Bitcoin Core would not contain any private keys and would be of very little value in coin/wallet recovery (at best, you'd get a list of addresses that you could view on a block explorer to see if they held any coins)

My bad i got these threads mixed up.

For the OP in this thread i would advise him to scan the drive in read only mode with testdisk and i am convinced that if it's still there, it will show the wallet as a deleted file with the ability to restore and save it to some other location given the one fact that the sectors have not been overwritten.

I see a lot of people advise these windows based recovery applications of which many need to be purchased and this is totally unnecessary.

You can download a free Linux live dvd and use that to boot up the computer to then mount the drive read only, then make a backup, and then start analyzing every last bit that is on that drive.

Download the ISO and either burn it to a dvd, or burn it to a USB stick using Unetbootin.
Then boot up the machine in copy to ram mode and start the terminator shell.
Then simply type testdisk and select the drive and scan it.

If unsure don't do anything and especially do not mess with the other settings so only use the analyzer function and leave the rest because if you make one mistake things will get worse.

[almightyruler]

For the OP in this thread i would advise him to scan the drive in read only mode with testdisk and i am convinced that if it's still there, it will show the wallet as a deleted file with the ability to restore and save it to some other location given the one fact that the sectors have not been overwritten.

An application that looks for specific wallet signatures would be a better idea, since it doesn't care whether metadata (such as folder and filename information) still exists. A wallet file which cannot be undeleted by standard utilities may still have recoverable fragments littered over the drive. Looks like pywallet performs such a function.

[SheriffBass]

Does Pywallet copy the wallet.dat file from old drives or does it extract the whole file where I can’t find it if I rescan The same drive again??

How do I check if the partial recovered/ recovered Pywallet is a valid wallet? If it said no key found do I still check it and how?? ( is there a simple easy way)??
Thank you,

[SheriffBass]

Personally I recommend you create an image of the drive before you start playing around as you might overwrite sensitive data
and have it as a backup.

Recovery attempts should never be done on the original drive.

From a forensic point of view, one should create 2 images (raw copies) and perform recovery on one of them.
Then after trying out a specific tool, a new raw copy should be created to try further recovery software on it.


One backup should always be kept safe and the original drive should never be touched with recovery software.


These are the basics of forensics.

"Laboratory techniques" of recovery trust solely the plates of original drive . The heads of any HDD are not perfectly positioned when the plates are spinning. so, in fact, the separate  track consists of thousands of "micro-tracks" tiny shifted from each other and the lab methods take an advantage of that, trying to use the best preserved "micro-tracks".

so u r saying that working off an exact bit by bit (sector by sector) clone is not as accurate? and will not properly search all files?
u still didn't answer my question!

does PYwallet extract a potential wallet.dat file from the hard drive? (Thus altering the data on the original hard drive) or does it simply copy( duplicate the wallet.dat file data)? (leaving the original hard drive as it was before the scan)