Old 2010 bitcoin wallet.dat

[rok95]

Hi

So I have managed to restore my HDD and found old 2010 wallet.dat it shouldn't be encrypted but it wasn't then I deleted it because I forgot that I mined BTC back then.
After 2years I managed to recover my wallet but befor I did that I installed bitcoin core on that same drive and download blockchain on diffrent drive when I look at properties it says creation date 2021 modification date 2010
Is it possible that it may be overwriten because before I manage to recover it I've been able to open it in text file and it was readable wallet.old
I remember when I had a piece of paper that some words were written on there and private key... I threw that paper away because I didn't know at a time it was from bitcoin there were 4 words written on there is it possible that I found encrypted wallet and could I decrypt this wallet with those 4words or back in the day bitcoin used 4word passphrase? or if anyone knows where can I get more information about bitcoin from 2009-2010?

Thank you

[plexasm]

Hi

So I have managed to restore my HDD and found old 2010 wallet.dat it shouldn't be encrypted but it wasn't then I deleted it because I forgot that I mined BTC back then.
After 2years I managed to recover my wallet but befor I did that I installed bitcoin core on that same drive and download blockchain on diffrent drive when I look at properties it says creation date 2021 modification date 2010
Is it possible that it may be overwriten because before I manage to recover it I've been able to open it in text file and it was readable wallet.old
I remember when I had a piece of paper that some words were written on there and private key... I threw that paper away because I didn't know at a time it was from bitcoin there were 4 words written on there is it possible that I found encrypted wallet and could I decrypt this wallet with those 4words or back in the day bitcoin used 4word passphrase? or if anyone knows where can I get more information about bitcoin from 2009-2010?

Thank you

If your wallet.dat isn't encrypted, you don't need any words to access it.

You're saying that Bitcoin Core (new version) created this file "wallet.old" when you attempted to view your wallet?

[HCP]

So I have managed to restore my HDD and found old 2010 wallet.dat it shouldn't be encrypted but it wasn't then I deleted it because I forgot that I mined BTC back then.

So you got an old HDD working... and then deleted your old wallet.dat?

After 2years I managed to recover my wallet but befor I did that I installed bitcoin core on that same drive and download blockchain on diffrent drive when I look at properties it says creation date 2021 modification date 2010

Then you managed to recover the deleted wallet.dat... but before you recovered that deleted file, you had already installed Bitcoin Core and run it?

Is it possible that it may be overwriten because before I manage to recover it I've been able to open it in text file and it was readable wallet.old

I'm a bit confused by what you've done... and what you actually have now... do you have TWO wallet.dat's? one from the recent install where you had the blockchain on the different drive... and the old "recovered" wallet.dat... or you do just have one wallet.dat?

I remember when I had a piece of paper that some words were written on there and private key... I threw that paper away because I didn't know at a time it was from bitcoin there were 4 words written on there is it possible that I found encrypted wallet and could I decrypt this wallet with those 4words or back in the day bitcoin used 4word passphrase?

Possibly either the passphrase for the Bitcoin wallet, but unlikely as encryption was added in September 2012 with version 0.4.0: https://bitcoin.org/en/release/v0.4.0 and you say your wallet was from 2010... or the 4 words could also have been a "brain wallet" used to generate the private key that was also written on the paper...

In either case, it's relatively moot, as you threw the piece of paper away

[mocacinno]

Is it possible that it may be overwriten because before I manage to recover it I've been able to open it in text file and it was readable wallet.old

It's possible, but it depends on how the HDD is used. If the HDD used to store heavy stuff such as OS, 3D application/game or write lots of files, it's very likely the wallet file is overwritten.
However, if you're serious to recover your wallet, first thing you should do is make RAW copy of your HDD.

exactly... Shut down your system right away, remove the HDD from your system and use a tool like dd to clone your disk without mounting it first... The longer you keep using the disk, the less chance you'll have recovering anything. Maybe you won't need the clone, but it's better to be safe than sorry!

[malevolent]

or the 4 words could also have been a "brain wallet" used to generate the private key that was also written on the paper...

I don't think there were any brainwallets actually in use by people back then, I first heard of this term in late 2011: https://bitcointalk.org/index.php?topic=51397.0;all

[axloisio]

Does anyone have the bitcoin wallet file from early 2010? I mined Bitcoin through the CPU in early 2010 but I ended up formatting the HD, recently I managed to find the HD and I'm trying to recover deleted file through Winhex, I would like to access a wallet from 2010 to know exactly the magic numbers in hex to find the private key. Please Help. I will give some bitcoins to whoever helps me. thanks

[Mushai]

You can try using pywallet as described here: https://bitcointalk.org/index.php?topic=5161349.40
Or maybe this: https://bitcointalk.org/index.php?topic=25091.0

[nc50lc]

Does anyone have the bitcoin wallet file from early 2010? -snip-

Take note that the wallet.dat file should be an intact-unloaded backup or newly created by those old versions.
An old backup that was loaded to some newer version could had been upgraded to that version's format.
(although nothing much have changed on an old/new legacy wallet's "magic numbers" appended to the private keys)

If you failed to get one, you can create it yourself:
Download the source from bitcoin core's github repo old archive here: https://github.com/bitcoin/bitcoin/tags?after=v0.2.11
Build it and create a wallet.

[mocacinno]

Does anyone have the bitcoin wallet file from early 2010? -snip-

Take note that the wallet.dat file should be an intact-unloaded backup or newly created by those old versions.
An old backup that was loaded to some newer version could had been upgraded to that version's format.
(although nothing much have changed on an old/new legacy wallet's "magic numbers" appended to the private keys)

If you failed to get one, you can create it yourself:
Download the source from bitcoin core's github repo old archive here: https://github.com/bitcoin/bitcoin/tags?after=v0.2.11
Build it and create a wallet.

If you're unable to build it yourself, i have started this project: https://mocacinno.com/

v0.2.11 can be found on dockerhub and ghcr.io
docker pull ghcr.io/mocacinno/mocacinno/bitcoin_core_docker:v2.11
docker pull mocacinno/btc_core:v2.11

If you don't trust my images (you probably shouldn't trust anybody with money), you can find the dockerfile here: https://github.com/mocacinno/bitcoin_core_docker/blob/v2.11/Dockerfile
you can either build the image yourself, or at least verify the image built on ghcr.io was built with this exact dockerfile

There's some basic documentation on how to use these images here: https://mocacinno.com/userdocs/ (but it's a work in progress, the usecase of recovering an old wallet has not yet been posted... If you need help, i'll quickly do a writeup this week and update the documentation)

[axloisio]

I formatted this hard drive at least twice and used it for a few years. I thought I had lost it, but when I moved I found it stored in a box.
I tried searching for the hex string "fd1701308201130201010420'', but no luck, I don't know if this prefix covers wallets from early 2010 or if all wallets contain the prefix 04 20 preceding a private key.

[nc50lc]

I formatted this hard drive at least twice and used it for a few years. I thought I had lost it, but when I moved I found it stored in a box.

I hope that you're working on a disk image or restored backup of the drive instead of the original.

I tried searching for the hex string "fd1701308201130201010420'', but no luck, I don't know if this prefix covers wallets from early 2010 or if all wallets contain the prefix 04 20 preceding a private key.

I have a for-test-only wallet.dat created with v0.1.3 and the consistent "magic number" before my private keys is: 0x01130201010420 but that wallet only has two keys.
Search for the famous 0x0201010420 if you need more result.

But that's a few months older than your target version;
however, as I've mentioned: there's nothing much changed in the magic number of old and some newer versions of legacy wallet.dat files.

Test wallet dump:

Code:

    "keys": [
        {
            "addr": "19NTMqGi3FCxqEzvhimnr77HmHpmRFs9ba",
            -snip-
            "secret": "6d4b2e44229ec5b6453fa199e2f66a6fddb2bee5c0754096f0625ebc7c1adde8"
        },
        {
            "addr": "1AwHLeDPncY8H7rcmGzfzRsDxiX7PUrJhA",
            -snip-
            "secret": "7b2ae95f74070bc1d7f5299b08e8184dc0d8dbc57d78c0b4b1a7871b8401c5b6"

Some screenshots (same prvKey above):
1.

2.

[PowerGlove]

I have a for-test-only wallet.dat created with v0.1.3 and the consistent "magic number" before my private keys is: 0x01130201010420 but that wallet only has two keys. (...)

That's a very helpful post, so please don't take my little nitpick the wrong way, but, the way you've written it looks to me like you might not realize that your test wallet actually does match the 12-byte pattern from the post that you're responding to (if you look carefully at your screenshots, then you'll see that your 7-byte pattern turns into the longer 12-byte one as you keep scanning left).

[Cricktor]

I formatted this hard drive at least twice and used it for a few years. I thought I had lost it, but when I moved I found it stored in a box.
I tried searching for the hex string "fd1701308201130201010420'', but no luck, I don't know if this prefix covers wallets from early 2010 or if all wallets contain the prefix 04 20 preceding a private key.

Formatting these days usually only means erasing old and writing new partitioning and filesystem data structures. In best cases it doesn't overwrite file contents, but file allocation is usually lost because filesystem structures are cleared and re-initialized as new.

With self-encrypting storage devices you can be less lucky, because if formatting the drive includes an erase (depends on the formatting software), you're out of luck. An erase of a self-encrypting device means, the device throws away the encryption key and this renders all sectors' content to bit garbage in fractions of a second.

TRIMming of SSDs is another challenge (mostly an obstacle) for data recovery as it highly depends on the storage device what kind of data is reported back for TRIMmed (marked as deleted) data sections. Most modern OSes use TRIM command when available for SSDs as it facilitates wear and garbage handling for the SSD controller.

But chances diminish when you say you used that drive after formatting. Using it means overwriting old content's sectors with new content which makes old overwritten content unrecoverable. It heavily depends how much new content was put on the drive after formatting.

And the ususal best practices when data recovery is performed: never work on the original data and storage media. Make a master forensic bit-by-bit copy, every sector of the source drive needs to be copied! If data content is really valuable, you make at least two redundant master copies.

From a master copy you make one or more working copies. You only work on the working copies!

[nc50lc]

That's a very helpful post, so please don't take my little nitpick the wrong way, but, the way you've written it looks to me like you might not realize that your test wallet actually does match the 12-byte pattern from the post that you're responding to (if you look carefully at your screenshots, then you'll see that your 7-byte pattern turns into the longer 12-byte one as you keep scanning left).

Nitpicks are very much welcome specially those that can correct mistakes with good explanation. (I miss o_e_l_e_o)

As for your take on the context of my reply, perhaps because the matching pattern is not distinctly mentioned.
In this case, I think it's a per-person basis, additional context will be based on how they think individually.

[CryptoJ0hn]

I tried searching for the hex string "fd1701308201130201010420'', but no luck, I don't know if this prefix covers wallets from early 2010 or if all wallets contain the prefix 04 20 preceding a private key.

This prefix is ​​for unencrypted wallets.
Your wallet may be encrypted with a password, although I can't say for sure in which version the encryption feature appeared in the Bitcoin client.
Try looking for the wallet.dat header "006231050009" and the data after it.

[nc50lc]

-snip- although I can't say for sure in which version the encryption feature appeared in the Bitcoin client.

I did some digging to answer that:
It's implemented in version 0.4.0, check the date here: https://github.com/bitcoin/bitcoin/tags?after=v0.5.0rc1
Here's the "readme" (release notes) at that time: https://github.com/bitcoin/bitcoin/blob/v0.4.0/doc/README#L28
The wallet encryption part isn't present in the previous release version 0.3.24.

[CryptoJ0hn]

It's implemented in version 0.4.0, check the date here: https://github.com/bitcoin/bitcoin/tags?after=v0.5.0rc1
Here's the "readme" (release notes) at that time: https://github.com/bitcoin/bitcoin/blob/v0.4.0/doc/README#L28
The wallet encryption part isn't present in the previous release version 0.3.24.

Yes, thank you, I already found this information myself.

But finding the wallet header might still be useful to him.