Lost coins in stupid way

[xmr9]

Hi,

I am stupid and I have lost 8k of BTC, but maybe you can help me... I have two seeds stored in txt file. I have checked both of seeds and found that one wallet is empty. Then I have deleted empty wallet seed and saved txt file. I don't know how, but I have deleted seed of 0.95BTC and stored empty wallet seed. I have not shut down my pc, but I have saved my txt file. My OS is Linux Mint. I have try some of the recovery soft, but all of them can't recover anything even my deleted photo The bad news that my SSD disk is encrypted with Linux encryption... Is there a way to recover my old file, or it's not possible?


I will send some nice tips if some helps me to recover.

Thank you all guys!

[mocacinno]

Is the file still open in a gui editor? Most gui editors support Ctrl-Z (even on linux).
By any chance, is the filesystem btrfs or another filesystem that supports snapshots? In that case you can see if there's an older snapshot available?
By any chance, did you mount an NFS or something... Try looking for .snapshots aswell.
If you saved the text on a locally mounted cloud service like dropbox, they also allow you to rollback (it's NOT a good idear to save sensitive data on a dropbox volume!!!)
Any backups?

Depending on the editor you used, some editors save a copy of your file when editing, and remove the old version and rename the copy when saving. In this case, you could probably do a scan for deleted files using a tool like testdisk. The more data you've written to your disk after saving the wrong seed, the lower your chances of recovering are...

For ~1 BTC i'd even recommand shutting down your system (unless you still have the editor opened, look at the very first line) and cloning your disk with dd. This way you have a full clone of your disk to retry different salvage tools

Just for the record: i don't like your odds... Sorry to be the barer of bad news... But for ~$8k I wouldn't just give up, and I'd probably try to get my funds back...

[NotATether]

Which wallet software are you using? Bitcoin core or Electrum or something else? Something about you mentioning seed phrases and Linux makes me think you're using Electrum. Did you set a password for the wallet? You can export the private keys and view the seed if you remember the wallet password, or if there's no password at all.

Can you make a transaction from your address with lost seed to an address associated with the other seed phrase you have?


If there was no wallet you can try running Ext4Magic with the path of your seed file, but you should stop downloading and writing things to disk or the deleted file might get overwritten by the disk, especially if your drive is almost full.
I assume your filesystem is ext4, I think it's the default filesystem created by Linux Mint.

https://wiki.archlinux.org/index.php/File_recovery#Ext4Magic

Code:

apt-get install ext4magic

Code:

ext4magic /dev/sdXY -f path/to/lost/file -R

Replace sdXY with the drive your seed file is located in.

[The Cryptovator]

Sorry for your loss, if I were you then wouldn't just give up. I am not using Linux, so I am not an expert on it, but this tutorial would help you. Read this article, How To Recover Deleted Files In Linux [Beginner’s Guide] . I am not sure if "TestDisk" is trusted software since I hadn't used it. Just you may try it where you hadn't stored any cryptocurrency or other sensitive info.

If in case you fail to do that then you can ask Bitcoin Wallet Recovery Services. Seems they have a good reputation wale the forum. They would ask a percentage of the fee if they could recover it successfully.

Anyway hope you have learned that seed shouldn't store into the device which has been using online. In the future, write it on your notebook or multiple papers and save it in multiple places. It's a lesson for other users.

[BitMaxz]

Can you try this method below.

- https://gist.github.com/bonyiii/1471379

I don't know if it will work on the encrypted disk you can try it but if it doesn't work you might need to find a way first to decrypt your SSD before this method will work.

Or try this script below.

- https://gist.github.com/jas-/adf4d4fbdea7d6436d40

Just modify it a little bit if which file you are trying to recover. I don't know if these old methods will work "nothing will be lose if you just try"

[Chikito]

Have you try PhotoRec or r-linux?, before using that software you should try to boot use live cd Linux to decrypting your SSD disk first. or It might be a good way if you running it all in Live cd.

[cryptoworld99]

Have you tried rolling back your linux OS environment $ apt-get -s install $(apt-history rollback | tr '\n' ' ') i can't promise that it will work but it's worth a shot.

[mocacinno]

Have you tried rolling back your linux OS environment $ apt-get -s install $(apt-history rollback | tr '\n' ' ') i can't promise that it will work but it's worth a shot.

this command rolls back packages after an upgrade. This won't help the OP. He deleted the wrong line from a text file and re-saved it afterwards, rolling back upgraded packages won't fix this i'm afraid.

[Willitivity]

Sorry about your lost. Don't be too hard on yourself as nobody is above mistakes but that was a really costly one. Anyway, I used linux mint first before trying out other distros and from to time, I make mistakes such as this but was able to get the deleted files back using these steps:


1) If it's not on your Desktop, you can put it there: Menu > System Settings > Desktop > change the Trash setting from Off to On.

Or, if you don't like icons on your desktop,

2) Menu > Files > Go > Trash. Opens the Trash folder and check for the .txt file

[nc50lc]

-snip-
I have checked both of seeds and found that one wallet is empty.
I don't know how, but I have deleted seed of 0.95BTC and stored empty wallet seed. I have not shut down my pc, but I have saved my txt file.

In what way did you found out that the other one has a balance?
Have you restored it through a Bitcoin wallet at some point and deleted the wallets??

[o_e_l_e_o]

If you are unable to recover the file yourself, there are a number of file recovery services which exist. All of them cost money, and all of them are a huge privacy and security risk as they involving handing over your hard drive (or at least, the clone of your hard drive you should have made) to complete strangers. Only you will know if 0.95 BTC is worth the financial cost and the security and privacy invasion to you personally.

Moving forward, I would suggest to anyone reading this thread that you never destroy your only copy of a wallet, private key, seed phrase, back up, or whatever. There is no telling when you might make a mistake like OP has, or someone sends you coins to an old address, or you need to sign a message from an old address to prove ownership, or a dozen other possible scenarios. There is no good reason to delete a wallet.

Sigh... why delete a wallet instead of moving it aside and keeping the old copy just in case?  You should never delete a wallet.

[NotATether]

Moving forward, I would suggest to anyone reading this thread that you never destroy your only copy of a wallet, private key, seed phrase, back up, or whatever. There is no telling when you might make a mistake like OP has, or someone sends you coins to an old address, or you need to sign a message from an old address to prove ownership, or a dozen other possible scenarios. There is no good reason to delete a wallet.

I’d go further and suggest that people designate an old device they don’t use anymore as storage for their old wallets and files and keep it disconnected from the internet. A lot of people are sloppy with their file management and forget where they put their backups, as well as other various important files on their main computer, which is just as bad as losing them. I’d go further and keep them all in the same folder like the desktop or documents folder.

If you don’t have an old computer then use an old Android and transfer the files with Bluetooth instead. I suspect that with the short lifespan of phones, most people have at least one they don’t use anymore.

[o_e_l_e_o]

I’d go further and suggest that people designate an old device they don’t use anymore as storage for their old wallets and files and keep it disconnected from the internet.

Everyone should do this as standard. You can buy external storage for about 25 bucks per terabyte. There is no excuse to not having all your important files and documents regularly backed up.

A lot of people are sloppy with their file management and forget where they put their backups, as well as other various important files on their main computer, which is just as bad as losing them.

There is little point in backing up the files on the same piece of hardware as the original files are stored. The only thing that protects you against is if you accidentally delete them or overwrite them. It does not protect against theft, loss, hardware failure or damage, natural disaster, etc.

[bob123]

Any updates? Any progress?
Did you already shutdown your PC or is it still running?

Overwriting a file does usually not immediately mean the old one is inaccessible anymore. But since this was 3 days ago, i guess you gave up on it already?

[xmr9]

Guys, I have try many of the method, but no luck, the biggest trouble is encrypted disk. all recovery programs is not working perfect with encrypted ssd. I have try to read disk sector by sector, but what I see that there are no old my file copy, so my summuary that when I have saved my txt file it was overwritten in the same sector. I am trying other methods like in CSI I will inform if some of them will work. I am decrypted my ssd copy and try to recover with all the paid/free programs, but they are not working good what I can see from the result. So i have got one software for criminalistic copy of the SSD disk, the process is very slowly, I will inform if it work for me and I will share news with community.

I have try this method also:

https://www.linuxquestions.org/questions/linux-general-1/how-to-recover-overwritten-file-774712/

[MrFreeDragon]

If you open and use the file before deleting it could store in the physical memory. So, I hope you already made a dump of your RAM.
The easy way to do it is to use rekall tool (http://www.rekall-forensic.com/):

Code:

$ cd rekall/tools/linux/
$ make

$ sudo insmod pmem.ko

$ sudo lsmod

$ dd if=/dev/pmem of=forensic_RAM_image.raw

$ rmmod pmem

Now the dump of your RAM is stored in forensic_RAM_image.raw file.

[Kakmakr]

If you open and use the file before deleting it could store in the physical memory. So, I hope you already made a dump of your RAM.
The easy way to do it is to use rekall tool (http://www.rekall-forensic.com/):

Code:

$ cd rekall/tools/linux/
$ make

$ sudo insmod pmem.ko

$ sudo lsmod

$ dd if=/dev/pmem of=forensic_RAM_image.raw

$ rmmod pmem

Now the dump of your RAM is stored in forensic_RAM_image.raw file.

To me ... I think it is already too late for that... it sounds as if he already rebooted the Operating System.. so whatever was stored in the RAM at the time, would be lost.

It also sounds as if he overwritten the previous txt file with new data... so he might have to find some forensic software that would be able to restore previous copies of the same text file and just hope that the same sector on the hard drive was not used to write the new txt file. 

Have you tried, "EaseUS Data Recovery" software?

[NotATether]

If you open and use the file before deleting it could store in the physical memory. So, I hope you already made a dump of your RAM.
The easy way to do it is to use rekall tool (http://www.rekall-forensic.com/):

~snip

Now the dump of your RAM is stored in forensic_RAM_image.raw file.

To me ... I think it is already too late for that... it sounds as if he already rebooted the Operating System.. so whatever was stored in the RAM at the time, would be lost.

It also sounds as if he overwritten the previous txt file with new data... so he might have to find some forensic software that would be able to restore previous copies of the same text file and just hope that the same sector on the hard drive was not used to write the new txt file. 

Have you tried, "EaseUS Data Recovery" software?

EaseUS only works on Windows and MacOS, not Linux Mint. I don’t think OP is in a position to take out his internal hard drive and attach it to a Windows computer to use that software and he said his disk is encrypted anyway so it will be impossible to read.

@MrFreeDragon dumping the RAM is a good first step but there is several other data we need to get before the seed can be searched for, like which address was the text editor program loaded at, where was its program data memory address, we also need to know which text editor OP was using so we can see where and how many blocks of memory are allocated for the text buffer, their sizes, and to get that info the source code needs to be inspected.

So for example if the text editor stores the whole file in a single large string buffer then chances are the seed phrase was overwritten if it was the first line of the file and that was deleted. But if it’s using some other data structure (highly probable if it has an undo/redo button) then the seed could be at some node whose memory was freed.

All of this becomes less possible to get as more time passes since the text editor was closed, because the RAM gets overwritten with other stuff. And if the OS is rebooted then the RAM is also zeroed IIRC (or maybe that’s only when power is disconnected).

[bob123]

EaseUS only works on Windows and MacOS, not Linux Mint. I don’t think OP is in a position to take out his internal hard drive and attach it to a Windows computer to use that software and he said his disk is encrypted anyway so it will be impossible to read.

And OP shouldn't do that, even if he could.
Windows is not able to read other file systems properly.

For forensic tasks, you should always use a linux-based distro. Especially if the OS from which you are trying to recover is a linux distro (i.e. linux file systems).

And if the OS is rebooted then the RAM is also zeroed IIRC (or maybe that’s only when power is disconnected).

When rebooting, there usually is a short period of time where the RAM is not powered.

[Iced]

Did you try Autopsy?

https://github.com/sleuthkit/autopsy/releases

[philipma1957]

@ op you fucked up.  It happens.  I still have 2 eth coins in a frozen wallet that I have not been able to recover.

I have an idea I will post it in about 10 -20 minutes.

[pawanjain]

Guys, I have try many of the method, but no luck, the biggest trouble is encrypted disk. all recovery programs is not working perfect with encrypted ssd. I have try to read disk sector by sector, but what I see that there are no old my file copy, so my summuary that when I have saved my txt file it was overwritten in the same sector. I am trying other methods like in CSI I will inform if some of them will work. I am decrypted my ssd copy and try to recover with all the paid/free programs, but they are not working good what I can see from the result. So i have got one software for criminalistic copy of the SSD disk, the process is very slowly, I will inform if it work for me and I will share news with community.

I have try this method also:

https://www.linuxquestions.org/questions/linux-general-1/how-to-recover-overwritten-file-774712/

OP you should try to give more information on your post like which text editor you were using, which wallet does the seed belongs to, do you have the wallet.dat with you etc..
These things would enlighten us more and will help to recover your funds quickly.

If you have the wallet installed on your system then you can simply export a new seed from it.
If you don't have the wallet in your system then this means you either manually typed the seed in a text file on your system or copied it through an external storage.
If you used an external storage to copy the seed then you can try to use recovery software on the external storage to recover the earlier version of text file.
If you copied from within your system then try to find if there are any clipboard recovery software.

[philipma1957]

I pointed a rental at solo.ckpool

@ op

maybe you get lucky and I hit a block.


https://solo.ckpool.org/users/146UJM5kgzLVUV23CXCf33KQKHckoX1gx3