Anyone tell me what this is showing?

[morbius55]

Ended.

[1714157327]

1714157327

[1714157327]

1714157327

[1714157327]

1714157327

[HCP]

It looks like the contents of a debug log file... I doubt it is a wallet file and/or will contain any private key data

CTxMemPool::accept() followed by the 64 hex chars is most likely a transaction ID... try doing a search on a blockexplorer for one of those 64 character hex strings to confirm.

[morbius55]

What is meant by a transaction? I don't think he really did any transactions or have I got the wrong end of the stick again That address being present again is annoying, why is it there and what is it saying about it?

[HCP]

What is meant by a transaction? I don't think he really did any transactions or have I got the wrong end of the stick again

No... it was the client accepting a "Transaction" (most likely from an external peer) as being "valid" and adding it to the local mempool of the node. It is not necessarily a transaction that the user of the local node was creating/broadcasting.

That address being present again is annoying, why is it there and what is it saying about it?

The thing that should concern you the most about that address is the fact that it says "ismine=0"... this, combined with the fact that it is being output from the "NotifyAddressBookChanged" function would tend to indicate that it had either been added as a "watching-only" address, or as a "Destination Address" (ie. an address that you're going to send coins to)... as the wallet does not appear to contain the private key for that address... otherwise it would have stated "ismine=1"

I would check the TXID that looks like it is output after it... and see if that TX was "Receiving" coins to that address... I suspect it was.

[morbius55]

What is meant by a transaction? I don't think he really did any transactions or have I got the wrong end of the stick again

No... it was the client accepting a "Transaction" (most likely from an external peer) as being "valid" and adding it to the local mempool of the node. It is not necessarily a transaction that the user of the local node was creating/broadcasting.

That address being present again is annoying, why is it there and what is it saying about it?

The thing that should concern you the most about that address is the fact that it says "ismine=0"... this, combined with the fact that it is being output from the "NotifyAddressBookChanged" function would tend to indicate that it had either been added as a "watching-only" address, or as a "Destination Address" (ie. an address that you're going to send coins to)... as the wallet does not appear to contain the private key for that address... otherwise it would have stated "ismine=1"

I would check the TXID that looks like it is output after it... and see if that TX was "Receiving" coins to that address... I suspect it was.

Thanks again for sharing your knowledge, I think I understand what your telling me. He possibly sent some funds to that address as a test after he had messed up? I don't believe he would know how to create a watching only address. That Python script you created looks good, sort of like a less moody pywallet. I haven't done a hex search for the 0201010420 marker on the whole drive yet. I suspect I would get thousands of hits. It would be awesome if the script rejected all addresses except the one you know contains funds. Cheers again.

[morbius55]

This is it it on blockchain explorer.
https://imgur.com/a/vuqfu9j

[bitmover]

That address being present again is annoying, why is it there and what is it saying about it?

As we can see in the block explorer, that transaction send the bitcoin back to the same address as change.

Using the same address as change is not recommended, and most wallets won't do that automatically (you have to do it manually). This is bad for privacy, as people can easily track how much bitcoin left your wallet.
New wallets always create a new address for change.

This is it it on blockchain explorer.

You just sent 0.067 to other person and received back 0.013 as change (you always need to receive the remaining balance of an input back as change)

[HCP]

This is it it on blockchain explorer.
https://imgur.com/a/vuqfu9j

I'm not sure how that relates to the "NotifyAddressBookChanged" snippet that I posted... the mostly obscured highlighted text (which should be the Bitcoin address) listed in there does not seem to match either of the addresses displayed in that transaction...

It's difficult because all the debug has been partially redacted, but I don't see the text: "MQwdmSZfau9X" in either of those addresses... are you sure you are looking at the correct transaction?

[morbius55]

This is it it on blockchain explorer.
https://imgur.com/a/vuqfu9j

I'm not sure how that relates to the "NotifyAddressBookChanged" snippet that I posted... the mostly obscured highlighted text (which should be the Bitcoin address) listed in there does not seem to match either of the addresses displayed in that transaction...

It's difficult because all the debug has been partially redacted, but I don't see the text: "MQwdmSZfau9X" in either of those addresses... are you sure you are looking at the correct transaction?

After the address comes ismine=0 status=1 received getdata for: tx and then the hash that you see that I have used on explorer.

[HCP]

weird... then is the highlighted text that has been partially redacted the Bitcoin Address? Because it doesn't look like that address is used in that transaction at all??!?

But like I said, it is very difficult to interpret what is going on when you're only providing heavily edited data

In any case, you're just looking at a debug.log from an early version of BitcoinQT (aka Bitcoin Core)... You likely won't discover anything of great value by analysing this.

[morbius55]

weird... then is the highlighted text that has been partially redacted the Bitcoin Address? Because it doesn't look like that address is used in that transaction at all??!?

But like I said, it is very difficult to interpret what is going on when you're only providing heavily edited data

In any case, you're just looking at a debug.log from an early version of BitcoinQT (aka Bitcoin Core)... You likely won't discover anything of great value by analysing this.

Yes it Is "the" Bitcoin address, just teasing me at every turn

[morbius55]

I can let you see a larger chunk of text if you think that is safe for me.

[morbius55]

weird... then is the highlighted text that has been partially redacted the Bitcoin Address? Because it doesn't look like that address is used in that transaction at all??!?

But like I said, it is very difficult to interpret what is going on when you're only providing heavily edited data

In any case, you're just looking at a debug.log from an early version of BitcoinQT (aka Bitcoin Core)... You likely won't discover anything of great value by analysing this.

Cheers.

[HCP]

It's a "valid" Bitcoin address... but the private key for that address is not in the wallet.dat that is currently loaded by Bitcoin-QT.

Instead, that is an address that has been added to the "Address Book"

If the private key was available, you would see something like this:



If it was just a random address, you would see output like this:



Once it has been added to the "address book":



It will have an "account" value displayed when you use validateaddress:




Unfortunately, it appears you are chasing shadows with this wallet.dat... the $1.7mil worth of BTC is not in this wallet.dat