wallet.dat and co

[HCP]

wallet.dat corrupted, recovery failed

"salvagewallet" failed then... It would appear that the wallet file is too corrupted for Bitcoin Core to be able to recover it. You will need to try an alternative method of extracting the private keys from the wallet.dat.

Unfortunately, most of the mthods available require the knowledge and use of command line tools and Python scripts like "PyWallet". These are not "start a program, click a button"-type solutions. Additionally, there is no guarantee that they'll be able to recover anything depending on how corrupted the wallet.dat is.

How much experience do you have with the commandline and Python scripts?

[1715070121]

1715070121

[1715070121]

1715070121

[1715070121]

1715070121

[Dydy94]

Hello. I have used pywallet before with:

--recover --recov_size --recov_device --recov_outputdir

I don't know where this is taking me

And with :

Pywallet 2.2 which does not work very well .. I could not get anything out of it

[HCP]

Hello. I have used pywallet before with:

--recover --recov_size --recov_device --recov_outputdir

Did you actually specify the correct values for those options? You need to specify the size of the device, what the device actually is, and where to put the output.

for example, if you were scanning a 8gig thumbdrive that was connected as F:, and you wanted to put the recovered files in C:\temp, you would use something like:

Code:

pywallet.py --recover --recov_size=8Gio --recov_device=F: --recov_outputdir=C:\temp

And with :
Pywallet 2.2 which does not work very well .. I could not get anything out of it

While it is true that PyWallet has not been updated in years, so it doesn't always play nicely with "new" versions of wallet.dat, it is still fairly useful. Unfortuantely, it to is somewhat limited with regards to what it can do if the wallet.dat file is really corrupted. Given that you're unable to load it into Bitcoin Core, it would appear that the wallet.dat is quite corrupted. Still, it could be worth a try.

maybe that's another problem?

Honestly, you'd need to copy/paste the actual contents of the debug.log file for people to be able to diagnose it properly. Giving us little snippets of the debug output does not help much The debug.log file is probably quite large, so my advice would be to shutdown Bitcoin Core, delete the debug.log file, try and restart Bitcoin Core.

After it has failed and shutdown again, then open debug.log again and copy/paste the entire contents of debug.log to https://pastebin.com/ and click the "create new paste" button. It will generate a unique URL for you. Finally, copy/paste that unique URL here.

NOTE: debug.log does not contain any "secrets", so you don't need to worry about anyone being able to steal your coins or anything, but it may reduce your privacy by showing IP addresses etc.

[mocacinno]

@Dydy94: non-english posts are only acceptable in the regional subforum... Your post will probably be deleted soon, so i tought i'd post the url to pastebin in case your post "dissapears":

https://pastebin.com/SwHLAAQT

[HCP]

Have you seen this post 11 file? Could it work?
Below.
https://bitcointalk.org/index.php?topic=2012533.0

As mentioned in that topic... it only works if your wallet.dat had no password.

If your wallet.dat had a password set, then the private key data is stored encrypted, so you cannot simply do a search with a hexeditor to retrieve the private keys.

[HCP]

As mentioned in the other thread, if your wallet file didn't have a password, you should be able to search the file for the hexstring: 0201010420

The 32 bytes of data following that string should be a private key (in hex). You can then use other tools like bitaddress.org to convert that hex to a private key in WIF format that could be imported into a wallet.


I quickly downloaded a free hex editor called "WinHex"... then opened a copy of an old wallet.dat that has no password... and did a hexstring search:



We use 020101420 as the string to search for:



This finds the following location in the wallet file:



So, now we want the next 32 bytes... a "byte" is TWO hex characters, so we want to copy the next 32 pairs of characters:





In this instance, we get:

Code:

3CF85D1E6E5DA399921269FC267A5832D5FA0CE302AD425AF9A388E6469B84C0

We put that into the "wallet details" tab on bitaddress.org and click "view details":



We get the following:



Now, that is just ONE key... the wallet.dat will have multiple locations of "0201010420", you need to find every instance of the hex 0201010420 in your wallet.dat and then get the 32 bytes following that and convert them to a private key.



Searching for individual hex private keys in a wallet.dat is a long, tedious process... honestly, using the PyWallet "dumpwallet" command is likely to be a lot easier:

Code:

pywallet.py --dumpwallet --wallet=Full\Path\To\Wallet\File > OUTPUTFILENAME

for instance, if my wallet file was in J:\Dump\ and called "wallet.dat", and I wanted to store the output in a file called walletdump.txt, I would use the command:

Code:

pywallet.py --dumpwallet --wallet=J:\Dump\wallet.dat > walletdump.txt

NOTE: When you open the walletdump.txt file, depending on how "old" the wallet file is, you might see a bunch of warnings like this:



That's fine, you can just ignore them... scroll down until you find the line that starts "The wallet is not encrypted":



All your private keys/addresses will be displayed below that. The private key (in WIF format) is the field labelled "sec".

[HCP]

Thank you for your explanations I already have the hexadecimal software and found the following 32 bytes.
The same goes for the walletdump.
There is a lot of key to import in both cases.
I will do it...

Yes, there is likely to be a minimum of 100 keys (That's what the old keypool minimum was)... at some point I believe the keypool was increased to 1000 keys.

But if I want to import everything with bitcoin core the whole thing, there must be wallets, encrypted keys or decrypted keys?
In this case in with --recover I have numbers in wallet.

I'm not sure what you mean by this exactly?

If you create a brand new wallet in Bitcoin Core, you will be able to import all the private keys using importprivkey command. It will be slow and annoying, but it will work.

Using --recover with PyWallet... should, theoretically, create a "valid" wallet.dat that you should be able to open using Bitcoin Core... Unfortunately, I do not know of an easy, realiable way to "corrupt" a wallet.dat so that I can test the "--recover" option with PyWallet and see if Bitcoin Core will then load the recovered wallet.dat

[HCP]

By that I mean that I don't have any key found in the wallet. But just one or more "wallets" found in the wallet.dat file.
....
(6 wallet
0 keys encrypted
0 keys decrypted)

Then it seems that PyWallet was not able to recover anything useful... it found 6 objects (while scanning the first 8gigs of F: drive) that it thought might be wallet.dat files, but was unable to actually retrieve any keys from these objects.

That could be caused by PyWallet only finding a small fragment of the wallet.dat file on the disk, or possibly that an incorrect wallet passphrase was used when trying to recover.

If dumpwallet (or the hex editor method) is allowing you to export the keys, then you're probably better off just ignoring the "--recover" option in PyWallet for now and just get to importing those private keys manually.

You can speed up the process by either:

1. when using importprivkey in Bitcoin Core, use the "false" value for the "rescan" argument... so:

Code:

importprivkey WIF_PRIVATE_KEY_GOES_HERE "" false

Until you get to the very last key... then use true... that way, Bitcoin Core will only run a rescan once for all the keys, rather than running rescan every time you run importprivkey (which can take a very long time!)

or

2. You can bulk import the WIF private keys into an SPV wallet like Electrum... it'll load and scan all the private keys in a matter of minutes.

[HCP]

No worries, glad to (hopefully) be of some help... please do keep us updated whether you are successful or not. It's nice to know what the final result was!

Good Luck!

[HCP]

You shouldn't attempt to run PyWallet with Python 3.8 (Python 3.x introduced a LOT of non-backwards compatible changes that can break a lot of scripts that were written for Python 2.x)... Note that Pywallet was written for Python 2.7.

So, I'd recommend uninstalling Python 3.8 (assuming you don't need it for anything else), and then installing the latest version of Python 2.7 for your OS from here: https://www.python.org/downloads/release/python-2718/

Once you have Python 2.7 installed, if you continue to get errors relating to "ecdsa", you need to install the "ecdsa" package using "PIP":

Code:

pip.exe install ecdsa

NOTE: pip.exe should be located in the "Scripts" folder where python.exe is located (by default, Python 2.7 installs to C:\Python27... so pip would be in C:\Python27\Scripts)

[Dydy94]

So, there I uninstall python38
(it says that it is not in the machine but it is marked in control panel and I cannot uninstall it completely, but all the files are in the recycle bin),
i reinstall python27, found pip and redirected it to python27.
1) I installed ecdsa and yet still the same errors ...
"ecdsa package is not installed pywallet won't be able To sign / verify messages."
2) There I tried again it seems that there is no more the ecdsa error .. !!! I am happy !!! Yes!

But again and again this message below
"Error: root: couldn't open wallet.dat / main. Tu quitting bitcoin and running this again."

It disgusts me...

After the sentence you whispered in my ear. I type entry I tone on that every time.

"Warning: root: pycrypto or libssl bit found, decryption may be slow Error: root: couldn't open wallet.dat / main. Tu quitting bitcoin and running this again."

As a reminder of the sentence or command line:

C: \ python27> pywallet.py --dumpwallet --datadir = C: \ DirWallet --wallet = walletfile.dat

"In search of the miracle x)"

[HCP]

Based on what you've written, the command (with proper spacing) should be:

Code:

C:\Python27\python.exe pywallet.py --dumpwallet --datadir=C:\DirWallet --wallet=walletfile.dat

NOTE: This command should be used in the folder where pywallet.py is located!

Also, is the wallet file actually called "walletfile.dat"? or is it the standard "wallet.dat"? Obviously, it's very important you type the correct filename! If you don't use the correct filename for the --wallet argument you will indeed get the error:

Code:

ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.

As, obviously, the script will be unable to locate the file


If you tell me:

1. The folder where Python.exe is located
2. The folder where pywallet.py is located
3. The folder where "wallet.dat" is located
4. The actual name of your wallet.dat

I will be able to give you the commandline to run that should dump the wallet contents for you.

[HCP]

Can I ask why you keep putting "spaces" in your posts? It's kinda confusing and difficult to tell if you're copy/pasting things which are "incorrect" or if it's just the way you're typing your posts!

Anyway... try and copy/paste this entire command exactly as it is shown:

Code:

C:\Python27\python.exe C:\Python27\pywallet.py --dumpwallet --wallet=C:\Python27\wallet.dat > wallet.txt

[HCP]

Yes... I should have mentioned that you're not likely to see any errors, but all the output will go to wallet.txt file.

In wallet.txt you might see a few hundred lines of weird errors like "Wallet data unknown" or something similar at the start... then you should see all the keydata output similar to this:

"keys": [
        {
            "addr": "1BitcoinAddressShownHere",
            "compressed": true,
            "hexsec": "b3xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx84",
            "private": "30xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx9b9",
            "pubkey": "02xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxb9",
            "reserve": 1,
            "sec": "LYOUR_WIF_PRIVATE_KEY_IS_KEY",
            "secret": "b3xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx01"
        },

The private keys in WIF format are highlighted above... in the "sec" field... you need to import those into the wallet of your choice.

[Dydy94]

Well ...
Another problem.
I write the correct command line. The one below:

C: \ Python27> python pywallet.py --dumpwallet --wallet = C: \ Python27 \ wallet.dat> wallet.txt.

And it is written "every time":

"Warning: root: pycrypto or libssl bit found, decryption may be slow Error: root: couldn't open wallet.dat / main. Tu quitting bitcoin and running this again."

do you have the solution to the problem, please?

Maybe there's nothing left on it? That's what I think

[mocacinno]

--snip--
C: \ Python27> python pywallet.py --dumpwallet --wallet = C: \ Python27 \ wallet.dat> wallet.txt.
--snip--
Error: root: couldn't open wallet.dat / main. Tu quitting bitcoin and running this again."
--snip--

A couple posts above, you gave following answer:

--snip--
3) C:\python27\wallet222.dat
4) wallet222.dat

Et le wallet.dat utilisé est dans "C:\Users\user\AppData\Roaming\Bitcoin\wallets

I do speak a reasonable amount of French (eventough you are not allowed to post non-english posts outside the regional subforum). But what i'm seeing here is that you named your wallet wallet222.dat. So, if there is no wallet.dat @c:\python27, the command will fail...

Maybe you could try:

Code:

C:\Python27>python pywallet.py --dumpwallet --wallet=C:\Python27\wallet222.dat> wallet.txt

Just on a sidenote, this debate has been going on for days, and i sometimes feel like we're going around in circles on this one... Is there anybody you trust for 100% that's tech-savvy and is able to help you with this task? Even if you're tech-savvy yourself, it wouldn't hurt to have a second pair of eyes looking at this thread while having physical access to your system (and the wallet-file itself).

[Btcspot]

 Hi, I think i can help with your wallet.dats. How many wallets do you have? Can you send the wallets like you say. I have some technique like pywallet that might work but i cant guarantee. But i could try. If we succeed you can send me fee or reward, i would ask not much. My programs work on damage wallets so it may work.
 Reply back or to my email:Awsuper@protonmail.com

[HCP]

is that on my command line:

C: \ Python27> python pywallet.py --dumpwallet --wallet = C: \ python27 \ wallet222.dat,
(Or another (wallet6.dat?)

Some wallets go in the text file
But it is written:

Wallet data not recognized: {'__ type__': 'keymeta', '__value__': "0xc \ x00 \ xea8 .... numbers letters and" \ "...}
"On several lines"
No "hexsec" nor "sec"

That is relatively normal... you'd need to scroll down a LONG way, like several hundred lines to find all the actual key data... The fact that it is finding "keymeta" data is a good sign... it means that it is actually a likely to be a wallet.dat file. It doesn't guarantee that it's not totally corrupted or the key data isn't encrypted, but it is a good starting point!

There should be a search time then possibly: "Warning: root: pycrypto or libssl bit found, decryption may be slow"

That simply means that python is missing a couple of libraries that can make it decrypt wallet data "faster"... but are not required if the wallet files have no password. It can generally be ignored.

But not :
"traceback (most recent call last):
File "pywallet.py", line 2111, in parse_wallet
d.update (parse_Blocklocator (vds))
TypeError: NoneType object I not iterable "

This generally happens with "new" wallet files that were updated/created using newer versions of Bitcoin Core... it added some database records to the wallet.dat files that PyWallet does not understand  There are ways around that, but it involves editing Python code, which I feel may be beyond you

Or:
"Error: root: couldn't open wallet.dat / main. Tu quitting bitcoin and running this again."

This happens when the wallet file specified using --wallet:
1. Does not actually exist
or
2. Is corrupted
or
3. Is already open and "locked" by Bitcoin Core
or
4. Is not actually a valid Bitcoin Core/bitcoind generated wallet.dat

I don't understand why it's so complicated. I understand why there are so many different topics here

Because you're getting into "non-standard" wallet manipulation territory... They were not designed to be easy to just randomly extract data from... they were designed to work with bitcoind/Bitcoin Core... When things go "wrong" and the wallet files get corrupted, things unfortunately become "difficult" if you're not familiar with commandline scripts etc.

What must be in my opinion is that the pywallet app is too old for what we ask.

Yes and no... if your wallet files are indeed from 2014 and haven't been "upgraded" to newer formats by newer versions of Bitcoin Core, Pywallet should work with them "OK".

option: I am ready to find someone I trust to whom I will priest my wallet and others, you never know.
Private message me so that I can see how we do it ...

This is a "Bad Idea"™  You'll likely get a lot of PMs from a lot of dubious characters asking for wallet.dat's and passwords (or asking for TeamViewer/Remote access etc) who'll promise you the earth and then just steal your coins

Be VERY careful whom you trust here!