recover keys from seed

[robg336699]

Hello all,

my friend thinks he has some bitcoin from 2009/2010 on a certain address and wants to recover it. He had a wallet.dat those days but it was deleted on his computer. But he also thinks to know the 24 words.

1.) We wanted to try the words on a ledger but the ledger supports only a fixed set of words.

My question:
Are there other tools or did exist in the past with which he could have generated keys from a free choice of words? And if yes, I suppose we have to find the correct tool which was used in the past?!

2.) We tried to find the wallet.dat in the deleted files on his computer.

My question:
Let's assume we found it, we would have to know, with what tool it was created, right?

Do you have any ideas or remember what were the common tools or applications for that during that time or do you have any other recommendation how to approach this?

Thanks a lot,

Brgds,

Robert

[AuorFedelmid]

Try this. https://iancoleman.io/bip39/

Although being that old I do not think BIP32 was around?

Choose 24 words at the top and BIP32 as Derivation path.

[BitMaxz]

If it was a wallet.dat then your friend is using Bitcoin_qt in the past and I'm sure they never support seed 12/24 words phrase and as you said he already tried it to import to ledger nano but it does not work. It seems the 24 words he has maybe is just random words.

So how did he get the 24 words?

If you can tell us if where the 24 words seed phrase generated maybe we can help you if what software you can recover your friend's wallet.

[robg336699]

If it was a wallet.dat then your friend is using Bitcoin_qt in the past and I'm sure they never support seed 12/24 words phrase.

So how did you get the 24 words?

If you can tell us if where the 24 words seed phrase generated maybe we can help you if what software you can recover your friend's wallet.

He's not sure after so long time ago, but he remembers that sentence which - maybe by coincidence - has exactly 24 words. So we thought maybe this could be it. I know that's not a lot of information... 

[AuorFedelmid]

Could it have been an Armory recovery phrase?

[Charles-Tim]

He's not sure after so long time ago, but he remembers that sentence which - maybe by coincidence - has exactly 24 words. So we thought maybe this could be it. I know that's not a lot of information... 

If truly he got bitcoin using a wallet as far back as 2009/2010, the wallet is non-deterministic and require addresses backup of the addresses bitcoin is transferred to. If he has the wallet file, that will be of help if not currupted. Or, if he backup the addresses it was sent too.

[NotATether]

Could it have been an Armory recovery phrase?

Armory phrases have 18 4-letter words so it's not possible.

He's not sure after so long time ago, but he remembers that sentence which - maybe by coincidence - has exactly 24 words. So we thought maybe this could be it. I know that's not a lot of information... 

Can you look up the words in the BIP39 or Electrum word lists (Google: "bip39 wordlist github" or "electrum wordlist github") to make sure that all those 24 words are in one of the lists? If words are not present or just scattered across both lists then it's not a true mnemonic phrase.

[robg336699]

He's not sure after so long time ago, but he remembers that sentence which - maybe by coincidence - has exactly 24 words. So we thought maybe this could be it. I know that's not a lot of information... 

If truly he got bitcoin using a wallet as far back as 2009/2010, the wallet is non-deterministic and require addresses backup of the addresses bitcoin is transferred to. If he has the wallet file, that will be of help if not currupted. Or, if he backup the addresses it was sent too.

Hi Charles-Tim,

thanks for your answer. The plan was that if we don't find the wallet to search for it by file signature on the hdd. That's the reason I'm asking if anyone knows how it could have been created these days so that I know what options could be and what to search for

[robg336699]

Could it have been an Armory recovery phrase?

Armory phrases have 18 4-letter words so it's not possible.

He's not sure after so long time ago, but he remembers that sentence which - maybe by coincidence - has exactly 24 words. So we thought maybe this could be it. I know that's not a lot of information... 

Can you look up the words in the BIP39 or Electrum word lists (Google: "bip39 wordlist github" or "electrum wordlist github") to make sure that all those 24 words are in one of the lists? If words are not present or just scattered across both lists then it's not a true mnemonic phrase.

[o_e_l_e_o]

He's not sure after so long time ago, but he remembers that sentence which - maybe by coincidence - has exactly 24 words.

If it is a sentence - as in, a coherent sentence which makes sense - then it is not a standard seed phrase. Seed phrases have 24 random words and do not make sense when read.

I am surprised he can remember these 24 words after 10+ years, which makes me think maybe it is a coherent sentence, which would be much easier to remember than 24 random words. If it is, then it might be a brain wallet. You could try downloading an open source brain wallet tool such as this one - https://brainwalletx.github.io/ - from GitHub, running it on an offline computer, entering the sentence, and then taking the address to an online computer and checking for funds.

[NotATether]

Hi Charles-Tim,

thanks for your answer. The plan was that if we don't find the wallet to search for it by file signature on the hdd. That's the reason I'm asking if anyone knows how it could have been created these days so that I know what options could be and what to search for

All wallet.dat files are actually Berkeley DB database files so the magic bytes for them are these:

00 00 00 00 01 00 00 00 00 00 00 00 62 31 05 00
09 00 00 00 00 20 00 00 00 09 00 00 00 00 00 00

Which operating system is this on? It'll help me recommend search tools as most work on one OS only.

You could try downloading an open source brain wallet tool such as this one - https://brainwalletx.github.io/ - from GitHub

Friendly reminder that I am self-hosting a brainwallet clone at https://brainwallet.notatether.com  

[robg336699]

Yes, right, it's a real sentence, not words from the word list. Using brainwallet below: Is generating the keys a standardized algorithm? I guess you could use any algo to generate some hash codes from words?

Regarding berkley db, I found some article about that and I recovered several .dat files with that signature. I tried to open with pywallet --dumpwallet and they gave an error like invalid or corrupt database but one had 16kb and returned sth like PAGE_NOT_FOUND. Should all wallets be openable with pywallet or are the wallets specific to the tool which generated it? Maybe the PAGE_NOT_FOUND indicates that it is a berkley db but I'm using the wrong tool to open it?

[o_e_l_e_o]

Using brainwallet below: Is generating the keys a standardized algorithm? I guess you could use any algo to generate some hash codes from words?

It is not standardized, partly because brainwallets are a terrible idea and anyone with any sense knows not to use them. However, every brainwallet generator I am aware of simply takes the SHA256 hash of your string, passphrase, sentence, whatever, since it handily generates a 256 bit output, which is the exact length of a bitcoin private key. I suppose the most likely modification to this would be to increase the iterations of SHA256 beyond one.

[BitMaxz]

~snip~

Don't focus on 24 words it seems it's not a backup seed much better to focus on the deleted wallet.dat you can recover the deleted wallet.dat if the HDD is untouched/overwritten.

Try this old guide on recovering wallet.dat below you will need to make a bootable Linux for this to recover the deleted wallet.dat file and let's hope the HDD it's not yet overwritten.

- https://bitcointalk.org/index.php?topic=25091.0

[pooya87]

Could it have been an Armory recovery phrase?

Armory phrases have 18 4-letter words so it's not possible.

Armory doesn't use "words" it is splitting the random characters into 4 letter groups with a space between them. Those characters are actually from Base-16 (similar to hexadecimal but using very different character set) and represent the entropy itself.

BIP-39 (the mnemonic proposal) was introduced in October 2013 and wasn't even complete back then. It became a thing mostly in 2014.
https://github.com/bitcoin/bips/blob/e6abf7e66d7a499696dc9ef152f2c9eaa5b1b8ef/bip-0039.mediawiki

[HCP]

Regarding berkley db, I found some article about that and I recovered several .dat files with that signature. I tried to open with pywallet --dumpwallet and they gave an error like invalid or corrupt database but one had 16kb and returned sth like PAGE_NOT_FOUND. Should all wallets be openable with pywallet or are the wallets specific to the tool which generated it? Maybe the PAGE_NOT_FOUND indicates that it is a berkley db but I'm using the wrong tool to open it?

All wallet.dat's are Berkeley DB's... but not all Berkeley DB's are wallet.dat's...

That is to say, just because you found a "random" .dat file that is a BerkeleyDB formatted file, does not mean it is a wallet.dat... what sort of filenames did these recovered files have? or did the recover software just find "random" file names?

Has your friend been actively using that HDD since the file was deleted over 10 years ago??!? (from 2009/2010) If so, the chances of recovering anything useful from "deleted files" is pretty much zero

Or has the old HDD just been sitting around gathering dust?