Newbie trying to import electrum file to electrum wallet

[alexislennon]

I have an electrum.zip file from a couple years ago. I have not unzipped it but I can see inside that the zip file has a few files .
Those files are
Bitcoin
Bitgo
Eth
Keys
password decoder
Private

I have downloaded the electrum wallet from electrum org but I am very confused what to do next. I have been reading this forum for hours but im having a hard time understanding what to do. Would you mind explaining to me, in the simplest terms possible, instructions so I can access this wallet?

[ranochigo]

Electrum backups are not in zip files. It was probably archived as a zip file by the user. Do you happen to have 12 word phrases or seeds?

Try extracting it to a directory and finding files without any extension. You can try importing them into Electrum by selecting "Choose..." when it prompts you to create a new wallet and select the file that you think is from an older Electrum backup.

[HCP]

Firstly... make a couple of copies of that .zip file as backup... Then you can experiment to your hearts content.

If the files don't have any extensions to them... they *might* be wallet files... but that .zip is certainly not just the contents of the Electrum data directory zipped up... it's missing a lot of stuff... Are you able to take a screenshot of the contents of the .zip file... upload it to somewhere like imgur.com and then paste the link here?

It'll give everyone a much better idea of what we're dealing with.

[BlackHatCoiner]

I guess you don't have the mnemonic phrase and thus I'll ask, inside the zip, do you have any file that contains the private keys on a wallet import format? Examples:

Code:

p2pkh: KwYsP3vaUcBT4uwZrTJigGtZA5e9t3Hj4q2rJv7eunym578EBRjo
p2pkh: KyjrcCZhFKbmNpfS75Y4UMrWWE5xKKKfBVR7FKBojcF3wipK4LTz
p2pkh: L4biJQ3Po475ejEigqsQLWcBkWazVxemrgNi7MjpyK1z1CDQKkSP
...

Code:

p2wpkh-p2sh: L2o2Z3dyqC5PcKVz2kFS1YiLmHKK2hcbXdYgzM2K9z1hmVfC7oNi
p2wpkh-p2sh: L1yFVKfpfUJ4EsdZbUCScGo8X5PLyh2cHaWZFnaW7w8oVWVWnwfY
p2wpkh-p2sh: L5kRriZcmPmSqDr5RJxdZSKJrhWzU4HpqMiwtJYQevXGKeUDKmS3
...

Code:

p2wpkh: KwF6QeysGrgxNSgqvA1X6jTtKMAExDywp3pRTf1hPTftb4t9m6Lm
p2wpkh: KyLR8kvH8jouPCN7GwbNJAwuS5M1QCgoSeMeTCh3Vv9TkJWh8FXq
p2wpkh: L29QniFbZyQXPVLV69bBU3fAxWTUHwDtZcvrkDRutVm1d5gVDqFx
...

If you do, then open your electrum, click "File" -> "New/Restore" -> Name your wallet -> "Import Bitcoin addresses or private keys" -> paste your private keys on that text field and hit "Next".

If you don't, then you may have your wallet backed up on a file without extension. Electrum probably allowed you to name that wallet file and if you open it with notepad it looks like that:

Code:

{
    "addr_history": {
        "bc1q20nh9hg3hphhj8wlq46kxm2457d3m42k0qa67u": [],
        "bc1q2rv3uwuhse7p95zs6evvygl6d9f6qpw3syyw8j": [],
        "bc1q3wdmt9zwju88hkqhfmfd6gzgxfu8nex8q4s66z": [],
        "bc1q6nze4ymafxwd604jha9hwjtunggwrhmjy6pdl9": [],
        "bc1q7ua3efyk8lzr4sq0fat0ykygz4dcm0hrs6jjvs": [],
        "bc1q8d9rydl3kpcv5tr63j93gvv8xmaxpfz26gvy8l": [],
        "bc1qa9cxqksu5wgj0774guqqefsvvzk29d8dj2mnnm": [],
        "bc1qcpk4p290xxvt6z8vcuhye2k408yqhgvtr6v28v": [],
        "bc1qctyr29wt6kc5mqn6cw0qy6dnlkh5jag92empvw": [],
        "bc1qf3n2r7dtle700dn8xg58tmqsu63f6593nvherc": [],
        "bc1qf84lg2y9zfltg9rnpptgkgst0fwvvyr43vsex6": [],
        "bc1qflpjcdfdr2z4rhu44klsqvn2sntgaj3dng4zrv": [],
        "bc1qghnqw0tye4n6m8t025glwjj08xmga3q48f3z6z": [],
        "bc1qgmvqf7zd9d70hh76eh8d2m27kpfk2uekkt2y0t": [],
        "bc1qh7y9je4mhqt5gx22anhayfasj5ekxy8fjdp9lq": [],
        "bc1qjp0rck7nt0jpjnegmyyd87zvc8vcn77a06hnpg": [],
        "bc1ql9mzrm8k70a89svtw6sexwfjh8akxsamztjgqu": [],
        "bc1qlspsh0et7gqnzhne0qymf67zxl725rr742jk95": [],
        "bc1qmjp4ec6cje5zc575rxnrllylehxmh8dm5d7zzr": [],
        "bc1qmy6t2gqxmm2h2lv02u3j9jdx9f43a8sxtnxwzw": [],
        "bc1qnltt9raarllfaxqzs9ku35g9kvslqky4xlztc5": [],
        "bc1qrw3z8phx3d9ku65rqkr5lvehqd4k6thaua6fk2": [],
        "bc1qsqs96utjpyl7ws3vxmvmcgrqcypwdenhfa9j7u": [],
        "bc1qt5kkc728y92e3evdr3sy97rwxkk2jrl9f2vg3x": [],
        "bc1qw0kpz4j7duj9hvqs29hnhl0f52qyku2dlrkstc": [],
        "bc1qwc67vyscqwm75tcech7h6rd9cx2x5g5g55zt7g": [],
        "bc1qx2a77mvddf7vazmw5r3y0sgx6p6tdh0t9nwlep": [],
        "bc1qx447sdgjk4ev23cs3cp9w64t9y8z5akrh5s9t5": [],
        "bc1qz40eqgzc37lxdn6nvq3ygk08aa3ya6uy0x2k5g": [],
        "bc1qz552fmlgdxphfdzcguxw835j5tu7njyvzqsxdg": []
    },
    "addresses": {
        "change": [
            "bc1qjp0rck7nt0jpjnegmyyd87zvc8vcn77a06hnpg",
            "bc1qf3n2r7dtle700dn8xg58tmqsu63f6593nvherc",
            "bc1qmy6t2gqxmm2h2lv02u3j9jdx9f43a8sxtnxwzw",
            "bc1qsqs96utjpyl7ws3vxmvmcgrqcypwdenhfa9j7u",
            "bc1qctyr29wt6kc5mqn6cw0qy6dnlkh5jag92empvw",
            "bc1qx447sdgjk4ev23cs3cp9w64t9y8z5akrh5s9t5",
            "bc1q2rv3uwuhse7p95zs6evvygl6d9f6qpw3syyw8j",
            "bc1q6nze4ymafxwd604jha9hwjtunggwrhmjy6pdl9",
            "bc1qlspsh0et7gqnzhne0qymf67zxl725rr742jk95",
            "bc1qw0kpz4j7duj9hvqs29hnhl0f52qyku2dlrkstc"
        ],
        "receiving": [
            "bc1q20nh9hg3hphhj8wlq46kxm2457d3m42k0qa67u",
            "bc1qghnqw0tye4n6m8t025glwjj08xmga3q48f3z6z",
            "bc1q7ua3efyk8lzr4sq0fat0ykygz4dcm0hrs6jjvs",
            "bc1q3wdmt9zwju88hkqhfmfd6gzgxfu8nex8q4s66z",
            "bc1q8d9rydl3kpcv5tr63j93gvv8xmaxpfz26gvy8l",
            "bc1qmjp4ec6cje5zc575rxnrllylehxmh8dm5d7zzr",
            "bc1qz40eqgzc37lxdn6nvq3ygk08aa3ya6uy0x2k5g",
            "bc1qf84lg2y9zfltg9rnpptgkgst0fwvvyr43vsex6",
            "bc1ql9mzrm8k70a89svtw6sexwfjh8akxsamztjgqu",
            "bc1qnltt9raarllfaxqzs9ku35g9kvslqky4xlztc5",
            "bc1qrw3z8phx3d9ku65rqkr5lvehqd4k6thaua6fk2",
            "bc1qgmvqf7zd9d70hh76eh8d2m27kpfk2uekkt2y0t",
            "bc1qx2a77mvddf7vazmw5r3y0sgx6p6tdh0t9nwlep",
            "bc1qcpk4p290xxvt6z8vcuhye2k408yqhgvtr6v28v",
            "bc1qa9cxqksu5wgj0774guqqefsvvzk29d8dj2mnnm",
            "bc1qt5kkc728y92e3evdr3sy97rwxkk2jrl9f2vg3x",
            "bc1qh7y9je4mhqt5gx22anhayfasj5ekxy8fjdp9lq",
            "bc1qflpjcdfdr2z4rhu44klsqvn2sntgaj3dng4zrv",
            "bc1qwc67vyscqwm75tcech7h6rd9cx2x5g5g55zt7g",
            "bc1qz552fmlgdxphfdzcguxw835j5tu7njyvzqsxdg"
        ]
    },
    "channel_backups": {},
    "fiat_value": {},
    "invoices": {},
    "keystore": {
        "derivation": "m/0'",
        "pw_hash_version": 1,
        "root_fingerprint": "41bd2529",
        "seed": "void student sugar dice divert expose buffalo service sheriff size oppose wreck",
        "type": "bip32",
        "xprv": "zprvAZ3hVcaU1cvoxexDGTgft4EGA7uQfQXTVwCavz3g71HfDMENptQo4YMUoMzByqACHcuZaLUdjjXG8vjuudKbdo4vAGDQCHi8Wa7yGuQruRL",
        "xpub": "zpub6n33u87MqzV7B92gNVDgFCAzi9ju4sFJsA8BjNTHfLpe69ZXNRj3cLfxedEnnnEgcwrde2vpvmNYJDR5wXPWihVVF6TwzFqCgR2HicLzrkZ"
    },
    "labels": {},
    "payment_requests": {},
    "prevouts_by_scripthash": {},
    "seed_type": "segwit",
    "seed_version": 32,
    "spent_outpoints": {},
    "transactions": {},
    "tx_fees": {},
    "txi": {},
    "txo": {},
    "use_encryption": false,
    "verified_tx3": {},
    "wallet_type": "standard"
}

You just open that file with electrum.

You may receive private messages from users that "want to help you". It may be meaningless to mention, but:

• Never reveal any private key(s).
• Never reveal any seed or mnemonic phrase.
• Never give your wallet file to anyone.
• Do not download any "legit" program that will "help" you recover your funds.

[alexislennon]

This is a screen shot of the folders contents


https://photos.app.[Suspicious link removed]/yDiM5jQfVDH3baWs7

Firstly... make a couple of copies of that .zip file as backup... Then you can experiment to your hearts content.

If the files don't have any extensions to them... they *might* be wallet files... but that .zip is certainly not just the contents of the Electrum data directory zipped up... it's missing a lot of stuff... Are you able to take a screenshot of the contents of the .zip file... upload it to somewhere like imgur.com and then paste the link here?

It'll give everyone a much better idea of what we're dealing with.

[alexislennon]

I can barely figure out how to use this forum

I tried to add a screenshot in my last post but the system removed it. I unzipped the solder and it has the same contents
those files are

FILE NAME               FILE TYPE              contents of file

bitcoin                       text doc              long string of letters and numbers beginning with  8fr
bitgo                         text doc              long string of letters and numbers beginning with  j8z
eth                            text doc              long string of letters and numbers beginning with  FVE
keys                          text doc              long string of letters and numbers beginning with SCO
passworddecoder      application            This file is not showing in the unzipped folder, only shows in the zipped
private                       text doc              long string of letters and numbers beginning with XWW

[joniboini]

Sounds like you used an encryption app to encrypt your files and then move them to a zip folder? Can't you recall anything from it? Maybe an encryption app you like in the past or something like that. Have you tried importing the "text doc" file to a wallet app, like "eth" to MetaMask or something to check if you changed the file extension?

The passworddecoder doesn't ring a bell, at least for me. Try using imgbb or imgurl to upload your image.

[alexislennon]

well this file was stored on my mega.nz account. its like google drive/dropbox . does that answer your question? No I havent tried metamask or importing to a wallet app- i dont know what meta mask is honestly I dont know much about this stuff

Sounds like you used an encryption app to encrypt your files and then move them to a zip folder? Can't you recall anything from it? Maybe an encryption app you like in the past or something like that. Have you tried importing the "text doc" file to a wallet app, like "eth" to MetaMask or something to check if you changed the file extension?

The passworddecoder doesn't ring a bell, at least for me. Try using imgbb or imgurl to upload your image.

[alexislennon]

Here is the screen shot of the zipped folder contents
https://ibb.co/m0TLKt8

[NotATether]

Here is the screen shot of the zipped folder contents
https://ibb.co/m0TLKt8

Yeah, you have to post a link to the image if you are a newbie. Only Jr. Members and above can directly post images.


First of all, do you remember where you got this ZIP file from before you put it on Mega? It sounds like you may have have created it yourself from looking at the file names, but if you didn't and you didn't receive it from a trusted friend either, but instead received it from a random place on the internet, the keys in there (if there are any) could already be compromised and known to some hacker.

Do you see any text beginning with "5H" "5J" "5K" or something like that? (Do not post them here: They are your private keys which might hold money).

Do you see any line that has twelve English words in it? (Do not post it either - that's a seed phrase which you import into a wallet and contains many private keys).

Does it have any lines beginning with 1, 3, or bc1? (This is safe, it is just your public address).

I think you get the point, don't paste the contents of the files if you believe they could contain secrets.

[dkbit98]

well this file was stored on my mega.nz account. its like google drive/dropbox

Keeping wallet files or backup phrase on cloud, mega, dropbox or google drive is a terrible idea, and some of those files from your screenshot are unrelated with Electrum.

As you are using Windows OS you can find Electrum datadir folder in this location after you enable hidden files:

\Users\YourUserName\AppData\Roaming\Electrum
or
%APPDATA%\Electrum

[HCP]

I can barely figure out how to use this forum

I tried to add a screenshot in my last post but the system removed it. I unzipped the solder and it has the same contents
those files are

FILE NAME               FILE TYPE              contents of file

bitcoin                       text doc              long string of letters and numbers beginning with  8fr
bitgo                         text doc              long string of letters and numbers beginning with  j8z
eth                            text doc              long string of letters and numbers beginning with  FVE
keys                          text doc              long string of letters and numbers beginning with SCO
passworddecoder      application            This file is not showing in the unzipped folder, only shows in the zipped
private                       text doc              long string of letters and numbers beginning with XWW

Here is the screen shot of the zipped folder contents

Honestly, none of that looks like it has anything to do with Electrum... The "Bitcoin" one might be an encrypted wallet file, but I suspect that it's likely just encrypted text (possibly private keys or the seed) which you need to use the "passworddecoder" app to decrypt.

Do you have any memory of how you created this .zip file and/or how it ended up in your mega.nz account?

[alexislennon]

awhile back i used it to purchase soe stuff on the dark web if i remember correctly.

that was on a different computer that i no longer own. at some point i started using mega.nz to store my files but forgot about it until recently.


none of the strings of letters in this file begin with "5H" "5J" "5K" There are no 12 words strings or  anything that begins with 1, 3 or bc 1



In regards to the password decoder, I can only see that file in the zipped folder. once I unzip it it is no longer there- how can i use it to decode the files?

[NotATether]

In regards to the password decoder, I can only see that file in the zipped folder. once I unzip it it is no longer there- how can i use it to decode the files?

This is an unknown program so don't run it on your laptop in case it is actually a virus.

My suggestion is to upload the "PasswordDecoder" file (only that one, not any of the others) using some file upload service and post it here for us to inspect.

I have a sandboxed Windows virtual machine which I can run it on.

[20kevin20]

I would suggest not uploading the executable file yet. Perhaps PasswordDecoder is a TXT file (or some other format) that has had just its extension edited. I used to do that before to camouflage some text, lol. Might contain sensitive info.

Do you have any antivirus installed? When you unzip an archive, Windows usually automatically removes files that are considered suspicious. Check Windows Defender (or any other antivirus that you might have installed) and see if the PasswordDecoder file has been quarantined (or removed) by it.

If your AV has quarantined the file, restore it. Right click the file and go to "Open with -> Notepad". Is there any intelligible text in it or just random, weird characters?

Would you mind counting how many characters the long string of characters the "bitcoin" file contains? PS: don't use a website to help you count the characters!)

[HCP]

Do you have any antivirus installed? When you unzip an archive, Windows usually automatically removes files that are considered suspicious. Check Windows Defender (or any other antivirus that you might have installed) and see if the PasswordDecoder file has been quarantined (or removed) by it.

If your AV has quarantined the file, restore it. Right click the file and go to "Open with -> Notepad". Is there any intelligible text in it or just random, weird characters?

Not entirely sure telling someone to override an AV quarantine on an executable file of dubious origins is really a good idea unless they know exactly what they're doing and how to deal with it properly... it's just as likely that the entire .zip file was actually "acquired" from a scammer/phishing site promising "bIg DoLlaZ!!!11!!1!!!" and that the passworddecoder is actually malware designed to install a RAT or clipboard hijacker or steal private keys/wallets etc.

Granted, Windows Defender can be a bit overzealous at times (it still often flags Electrum as being "suspect", regardless of how many times I report it as "Safe" )... but still, unless the OP has a VM they can play with it in... they should not just be blindly removing files from quarantine.

[alexislennon]

how can i upload a zip file to here

[HCP]

how can i upload a zip file to here

You can't directly host files here... you will need to upload it to a file hosting service of some description and then post the link here.

[NotATether]

I would suggest not uploading the executable file yet. Perhaps PasswordDecoder is a TXT file (or some other format) that has had just its extension edited. I used to do that before to camouflage some text, lol. Might contain sensitive info.

Not possible in this case. OP has file extensions turned off so if this was actually a text file, it would've been called PasswordDecoder.exe but have a notepad icon on it.

Besides, all Windows programs start with the hex string "0x50 0x45 0x00 0x00", somebody can use a text editor to easily verify this is the case for this executable as well.

Do you have any antivirus installed? When you unzip an archive, Windows usually automatically removes files that are considered suspicious. Check Windows Defender (or any other antivirus that you might have installed) and see if the PasswordDecoder file has been quarantined (or removed) by it.

The antivirus does not mark downloaded internet files as suspicious, Windows itself does. Files downloaded using the programming API of Windows have an Alternate Data Stream (ADS) created inside the file that marks the file as "Downloaded from the internet" and then shows the "This file cannot be verified" warning when you try to run a program with this ADS inside (it has no special meaning for regular files files and folders). If a ZIP folder that has this Alternate Data Stream inside it, then all files you extract from it also get this ADS tagged on it. It never ever passes through an antivirus unless is has some real-time protection thingy turned on.

https://hshrzd.wordpress.com/2016/03/19/introduction-to-ads-alternate-data-streams/

^--- this is additional information, you do not need to understand it to solve this problem!

If your AV has quarantined the file, restore it. Right click the file and go to "Open with -> Notepad". Is there any intelligible text in it or just random, weird characters?

Blue part is a bad idea (and not because you disagreed with me above) because Notepad will freeze if you open files that are several megabytes large.

how can i upload a zip file to here

You need to use a file uploading service.

Gofile (https://gofile.io/) is my preferred file uploaded because it automatically deletes the files after a certain period of time if nobody downloads from them.

I still do not recommend uploading the entire ZIP file just yet (despite what other people said above) let's see what happens when the EXE is uploaded by itself and what it actually does. Then once we find out you can PM the other files to some trusted members on this board.

My worry is that the files could have private keys hidden inside them that someone could steal if you post them publicly.

[alexislennon]

I was just going to upload the zip file with only the password decoder file in it