Wallet.dat recoverd and corrupted (Help withHEX and pywallet)

[Ragnass]

Hello together,

i am the new one her 

i have a corrupted wallet.dat. The Wallet was Bitcoin-QT 0.8.0 Beta.

So i do a lot of thinks to get my keys back.

With Hex i get a code HEX 64 bit. For the Hex date search i have used 0204010120.
I dont not what to do with this code. The Tools from the old topics dont work anymore (https://github.com/pierce403/keyhunter).
Maybe my technical knowledge is not enough.
Any help or something what i can do with this 64 bit code?


I also run pywallet, but i only get unencryptet keys (130). No encryptet key and no wallet.dat




Iam not a computer expert so please be indulgent.

Thanks a lot for any help

[1714931104]

1714931104

[1714931104]

1714931104

[Ragnass]

Update:
I have uncompressed the HEX 64 bit code an it is nothing at the adress.

Can someone tell me what is means thet i get at pywallet unencrypted keys (130)and No encryption key and no wallet found.

I also have a question about hex usage. How do I know which HEX search number to enter? I've tried 0204010120. I have see this code at Youtube,
but here someone used a different code to search for the HEX file.


Thanks a lot for any help 

[HCP]

If the search for the 0204010120 hex code is successful, then it sounds like your original wallet.dat was unencrypted. This also seems likely as PyWallet is finding "unencrypted" keys.

That is good, as it makes it a lot easier to recover, as all you need to do is take all the 130 "unencrypted keys" from PyWallet and import them into the wallet of your choice. How did you go about converting the 64 bit HEX into an address?

Are you able to use the dumpwallet option in PyWallet? Does that output all the keys/addresses?

[Ragnass]

Hello and thanks for your answer.

For Hex i have used the standalone from this topic (https://bitcointalk.org/index.php?topic=43496.0). But the adress have no BTC. The Hex  Code was found in database.log0001 not in the wallet.dat so i think the hex code is an impasse.

All the unencrypted keys have nine numbers with plus one letter.


This are the results after run with pywallet version 2.3


Found 0 possible wallets
Found 0 possible encrypted keys
Found 130 possible unencrypted keys


All the found encrypted private keys have been decrypted.
Traceback (most recent call last):
  File "pywallet.py", line 4875, in <module>
    db_env = create_env(options.recov_outputdir)
  File "pywallet.py", line 1269, in create_env
    r = db_env.open(db_dir, (DB_CREATE|DB_INIT_LOCK|DB_INIT_LOG|DB_INIT_MPOOL|DB_INIT_TXN|DB_THREAD|DB_RECOVER))
bsddb.db.DBRunRecoveryError: (-30974, 'DB_RUNRECOVERY: Fatal error, run database recovery -- D: No such file or directory')


Have i do somethin wrong?
And was is my next step?

Thanks a lot

[Ragnass]

Thanks for the link.


I created an intact wallet.dat with the Bitcoin-qt version 0.8.0. and will run pywallet on this data. After the test, I came to a similar result (150 unencrypted keys with 10 numbers). the 130 found unencryted keys are probably correct.
However, I don't know what to do with the created file (pywallet_partial_recovery_)?



I also wonder what kind of error I get at bsddb???

Found 0 possible wallets
Found 0 possible encrypted keys
Found 130 possible unencrypted keys


All the found encrypted private keys have been decrypted.
Traceback (most recent call last):
  File "pywallet.py", line 4875, in <module>
    db_env = create_env(options.recov_outputdir)
  File "pywallet.py", line 1269, in create_env
    r = db_env.open(db_dir, (DB_CREATE|DB_INIT_LOCK|DB_INIT_LOG|DB_INIT_MPOOL|DB_INIT_TXN|DB_THREAD|DB_RECOVER))
bsddb.db.DBRunRecoveryError: (-30974, 'DB_RUNRECOVERY: Fatal error, run database recovery -- D: No such file or directory')

[Ragnass]

The error with bsddb have bin fixed (my bad).

now this are my results after using pywallet:

Found 0 possible wallets
Found 0 possible encrypted keys
Found 130 possible unencrypted keys
Traceback (most recent call last):
  File "pywallet.py", line 4887, in <module>
    crypter.SetKeyFromPassphrase(passphraseRecov, NPP_salt, NPP_rounds, NPP_method)
  File "pywallet.py", line 770, in SetKeyFromPassphrase
    len(vKeyData), nDerivIterations, ctypes.byref(self.chKey), ctypes.byref(self.chIV))
WindowsError: exception: access violation reading 0x0000000092B99B88


Please someone can tell me what to do and is there any hope to get the key?


Thanks a lot

[HCP]

That seems like some sort of memory access error... do you have any AntiVirus/AntiMalware software running? If you do, it's possible that it's conflicting with python attempting to access certain things.

Either try turning it off (including Windows Defender) and try again... and/or try running your command prompt in administrator mode.

Also, what is the exact commandline that you are using?

This are the results after run with pywallet version 2.3

Where did you find PyWallet version 2.3? The latest version that I'm aware of is 2.2.

[NotATether]

Pywallet has two internal functions inside the dumpwallet command, read_wallet() and export_all_keys(). The former turns the wallet.dat (which is just a Berkeley DB) into a JSON format by reading all of the columns and rows. The later just exports the "keys" field of the converted JSON format, which is the one where your private keys are actually stored.

It's possible that some of those tables are corrupted but the important thing is we need to find out whether the keys table is fully intact or not and then copy that table to a clean Berkeley DB for proper reading and recovery. Standard database readers including pywallet will not be able to open this file and it's possible this file has to be manually assembled by hand, or by means of a script that locates the bytes of the keys table and writes a clean database by its default byte structure.

If the keys table is corrupted then all bets are off.

[Ragnass]

Thanks for your answers.

I get the Version 2.3 from here (https://github.com/mikeborghi/pywallet)
I hope its the right one?
The exact commandline is: ython pywallet.py --recover --recov_device=F: --recov_size=8Gio --recov_outputdir=D:\

I always get the code:
Found 0 possible wallets
Found 0 possible encrypted keys
Found 260 possible unencrypted keys
Traceback (most recent call last):
  File "pywallet.py", line 4887, in <module>
    crypter.SetKeyFromPassphrase(passphraseRecov, NPP_salt, NPP_rounds, NPP_method)
  File "pywallet.py", line 770, in SetKeyFromPassphrase
    len(vKeyData), nDerivIterations, ctypes.byref(self.chKey), ctypes.byref(self.chIV))
WindowsError: exception: access violation reading 0x0000000092B99B88


Have do a lot of thinks like this: BCDEDIT /SET {CURRENT} NX ALWAYSOFF
But i cant run it.

[HCP]

--recover is used more to find wallet.dats that were deleted... not generally for when you actually have the wallet.dat file showing in the file listings. It basically just reads raw bytes from the device and attempts to find and recover "lost" wallet.dat files (with varying degrees of success )

If you have a wallet.dat file, you're better off trying to use the dumpwallet command:

Code:

python pywallet.py --dumpwallet path\to\wallet.dat

So, if the wallet.dat is in the same location as pywallet.py, then you can simply use:

Code:

python pywallet.py --dumpwallet wallet.dat

If it was in a location like F:\Bitcoin\wallets, you would use:

Code:

python pywallet.py --dumpwallet F:\Bitcoin\wallets\wallet.dat

[Ragnass]

Thanks

i have allready do the command:
python pywallet.py --dumpwallet path\to\wallet.dat
There is always the message that the btc must be closed.
I've already read this error from other people here in the forum. The tips are dont work with delete some or all data in the BTC Folder and only left the wallet.dat in the folder.
Thats why i use the pywallet_partial_recovery_ command.

I think that i have the same problem like this guy https://bitcointalk.org/index.php?topic=1404609.msg14257235#msg14257235
But the current attempts just show me 130 unencrypted keys. Note: a correct file newly created with btc-qt version 0.8.0 also only shows me 150 unencrypted keys.
Therefore i hope that will be not to late

Tomorrow i will check the pywallet.py programm with LINUX. Hope that is work without error.

[HCP]

i have allready do the command:
python pywallet.py --dumpwallet path\to\wallet.dat
There is always the message that the btc must be closed.

If it is giving you and error that says:

Code:

"ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.

it means that the file is quite badly corrupted and it's unable to be opened as the standard wallet file.


The --recover option should rebuild and create an actual "valid" wallet.dat file in the output directory. You should then be able to use dumpwallet on the generated wallet.dat

NOTE: I lead you astray with the command... it should be:

Code:

python pywallet.py --dumpwallet --wallet=full\path\to\wallet.dat

Apologies! 


As for the access violation when using --recover... what size is your F: drive that you're trying to recover from? It's possible that your --recov_size=8Gio parameter is wrong, so PyWallet is trying to search past the end of the disk and generating the error?

[Ragnass]

Thanks for all tips

With another Laptop also with Win 10 all haved work fine.
I also used the command: pywallet_partial_recovery_ on this Laptop.
Thanks the guys for the great work with Pywallet.
I have my keys back

[HCP]

I have my keys back

Awesome, glad you managed to get it sorted... now I would suggest making some backups of your wallet.dat and keys to prevent the same thing happening again!