corrupted wallet, salvagewallet command not working (Bitcoin Core)

[catLitter11]

I have an old bitcion wallet dat file. Bitcoin core says it is corrupted. I followed some tutorials online to try using the salvage command but when bitcoin core starts up I get hit with a "Error parsing command line arguments: Invalid parameter -salvagewallet."

I'm typing in cd C:\ProgramFiles\Bitcoin\bitcoinqt.exe -salvagewallet to an elevated command prompt

I've tried it both on Win10 and Win7.

[1715347065]

1715347065

[1715347065]

1715347065

[HCP]

the -salvagewallet command was removed from Bitcoinqt.exe... as it was moved to the bitcoin-wallet.exe tool

You should find that in the "C:\Program Files\Bitcoin\daemon" folder... and the command was also renamed to just salvage

Code:

Bitcoin Core bitcoin-wallet version v0.21.0

bitcoin-wallet is an offline tool for creating and interacting with Bitcoin Core wallet files.
By default bitcoin-wallet will act on wallets in the default mainnet wallet directory in the datadir.
To change the target wallet, use the -datadir, -wallet and -testnet/-regtest arguments.

Usage:
  bitcoin-wallet [options] <command>

Options:

  -?
       Print this help message and exit

  -datadir=<dir>
       Specify data directory

  -wallet=<wallet-name>
       Specify wallet name

....


Commands:

  create
       Create new wallet file

  info
       Get wallet info

  salvage
       Attempt to recover private keys from a corrupt wallet. Warning:
       'salvage' is experimental.

[catLitter11]

Ah, thanks for that. That did the job. However, it still says the wallet is corrupted. I was trying to use pywallet but I've been getting an " 'ecdsa' package is not installed, pywallet won't be able to sign/verify messages       A mandatory option is missing "  I tried installing ecdsa but wasnt sure where to install it, into the python27 folder or program files etc and what exactly I need to do to get it working with python. (I dont know much about python.)

What I'm typing in in the command window is: "python pywallet.py –dumpwallet > wallet.text --passphrase= PASSPHRASE".

Also, I get an "error: no such option: -u" in the command window" unless I change the "-dumpwallet" to "--dumpwallet", so Im not sure if that's a mistake on the part of the website where I copied the python code from or what.  And finally, it says "pycrypto or libssl not found, decryption may be slow" but Im not sure that's even a problem.

[HCP]

Ah, thanks for that. That did the job. However, it still says the wallet is corrupted. I was trying to use pywallet but I've been getting an " 'ecdsa' package is not installed, pywallet won't be able to sign/verify messages       A mandatory option is missing "  I tried installing ecdsa but wasnt sure where to install it, into the python27 folder or program files etc and what exactly I need to do to get it working with python. (I dont know much about python.)

To fix the ecdsa error, you just need to install the ecdsa Python module using pip:

Code:

python pip install ecdsa

Although, it's not actually required.

What I'm typing in in the command window is: "python pywallet.py –dumpwallet > wallet.text --passphrase= PASSPHRASE".

Also, I get an "error: no such option: -u" in the command window" unless I change the "-dumpwallet" to "--dumpwallet", so Im not sure if that's a mistake on the part of the website where I copied the python code from or what. 

The commandline you're using is wrong.

everything after the > won't be available to pywallet... so, the --passphrase parameter is in the wrong place... also the > command tells the OS where to redirect the output of the script... so instead of displaying it to the screen, it is attempting to write it to a file called "wallet.text --passphrase= PASSPHRASE"

So, try something like this:

Code:

python pywallet.py --dumpwallet --datadir=. --passphrase=YOUR_WALLET_PASSPHRASE_GOES_HERE > wallet.text

This assumes that the wallet.dat you're trying to dump info from is in the same folder that pywallet.py is in... and it is called "wallet.dat". Where exactly is your corrupt wallet.dat located and what is the filename?

And finally, it says "pycrypto or libssl not found, decryption may be slow" but Im not sure that's even a problem.

It's not... as it says, it just might slow down the decryption, but you're talking seconds rather than minutes or hours etc.

[catLitter11]

Yes, my wallet.dat is in my pywallet folder and is labeled "wallet.dat"
I'll try that now with ecdsa.

BTW I've tried using the datadir command but pywallet says it's been removed:
REMOVED OPTION: put full path in the --wallet option
  -w WALLETFILE, --wallet=WALLETFILE
                        wallet filename (defaults to wallet.dat)

And also I dont know the passphrase to the wallet. It's 6 years old or so. It appears to be encrypted basing off all the characters and symbols when I open it in notepad.

[HCP]

BTW I've tried using the datadir command but pywallet says it's been removed:
REMOVED OPTION: put full path in the --wallet option
  -w WALLETFILE, --wallet=WALLETFILE
                        wallet filename (defaults to wallet.dat)

Oh ok... you're using the "new" version of Pywallet... I have a feeling that the latest version might actually require Python 3 and not Python 2.

In any case... try:

Code:

python pywallet.py --dumpwallet --wallet=./wallet.dat --passphrase=YOUR_WALLET_PASSPHRASE_GOES_HERE > wallet.text

And also I dont know the passphrase to the wallet. It's 6 years old or so. It appears to be encrypted basing off all the characters and symbols when I open it in notepad.

Opening in notepad is guaranteed to show all sorts of weird characters and symbols, because notepad is for text based files... and a wallet.dat is a binary database file. So, it isn't necessarily encrypted... but chances are pretty good that it is.

However, if the file is indeed encrypted and you don't have the passphrase, you're not going to be able to recover the private keys. It's as simple as that. You can try running without the --passphrase option and see if you get the "Sec" fields that show the private keys...

Code:

python pywallet.py --dumpwallet --wallet=./wallet.dat > wallet.text

If you only get addresses/public keys... and you don't see any "sec" fields with WIF private keys and hex private keys, then the file is encrypted.

[catLitter11]

BTW I've tried using the datadir command but pywallet says it's been removed:
REMOVED OPTION: put full path in the --wallet option
  -w WALLETFILE, --wallet=WALLETFILE
                        wallet filename (defaults to wallet.dat)

Oh ok... you're using the "new" version of Pywallet... I have a feeling that the latest version might actually require Python 3 and not Python 2.

In any case... try:

Code:

python pywallet.py --dumpwallet --wallet=./wallet.dat --passphrase=YOUR_WALLET_PASSPHRASE_GOES_HERE > wallet.text

And also I dont know the passphrase to the wallet. It's 6 years old or so. It appears to be encrypted basing off all the characters and symbols when I open it in notepad.

Opening in notepad is guaranteed to show all sorts of weird characters and symbols, because notepad is for text based files... and a wallet.dat is a binary database file. So, it isn't necessarily encrypted... but chances are pretty good that it is.

However, if the file is indeed encrypted and you don't have the passphrase, you're not going to be able to recover the private keys. It's as simple as that. You can try running without the --passphrase option and see if you get the "Sec" fields that show the private keys...

Code:

python pywallet.py --dumpwallet --wallet=./wallet.dat > wallet.text

If you only get addresses/public keys... and you don't see any "sec" fields with WIF private keys and hex private keys, then the file is encrypted.

I ran the second command (without the passphrase line, due to not knowing what the password is.) In the command window it outputted an "error: unpack_from requires a buffer of at least 4 bytes", and above that it outputted four lines all starting with "File "pywallet.py, line xxxx," the x's being numbers. Looks normal I imagine but just throwing it in here anyway (because I have no idea  )

When I open the wallet.text file it reads:
"ERROR parsing wallet.dat, type tx"
"Key data: *random characters*"
"Key data in hex:"
*a bunch of numbers and letters*
"value data in hex:"
*a ton more numbers and letters*

[HCP]

are you trying to run pywallet on (a copy of) the original wallet.dat or a copy of the wallet.dat after you tried bitcoin-wallet.exe and salvage?

It looks like the file might be quite badly corrupted if it's unable to parse the data correctly

[catLitter11]

are you trying to run pywallet on (a copy of) the original wallet.dat or a copy of the wallet.dat after you tried bitcoin-wallet.exe and salvage?

It looks like the file might be quite badly corrupted if it's unable to parse the data correctly

Sorry for delayed response. I am running pywallet on a copy of the wallet.dat that I already attempted to -salvage.

When I initially found the bitcoin wallet dat file I made a copy of it which is the copy I've been working on.

[HCP]

I am running pywallet on a copy of the wallet.dat that I already attempted to -salvage.

In that case... it might be better to make another copy of the original... and then see if PyWallet is able to parse that or if you get the same error. If you still get the same error, then it's possible that the recovered wallet.dat db structure is simply too corrupted for PyWallet to be able to read properly

Recovery gets quite a bit more difficult if that is indeed the case

[catLitter11]

I am running pywallet on a copy of the wallet.dat that I already attempted to -salvage.

In that case... it might be better to make another copy of the original... and then see if PyWallet is able to parse that or if you get the same error. If you still get the same error, then it's possible that the recovered wallet.dat db structure is simply too corrupted for PyWallet to be able to read properly

Recovery gets quite a bit more difficult if that is indeed the case

Yeah, that looks to be the case because it's saying the same thing. Oh well. Thanks for your help.

[HCP]

Yeah, you'll likely need to start messing about with hex/byte level stuff to see if you can locate the private key data within the wallet.dat.

When you say it was an "old" wallet.dat, did you find it on an old drive/backup... or was it recovered using file recovery software (ie. a "deleted" file)?

[catLitter11]

Yeah, you'll likely need to start messing about with hex/byte level stuff to see if you can locate the private key data within the wallet.dat.

When you say it was an "old" wallet.dat, did you find it on an old drive/backup... or was it recovered using file recovery software (ie. a "deleted" file)?

It was on an old USB drive.

[HCP]

I'm a little surprised that it is coming up as corrupted then... unless the drive is suffering from "bit rot", or the device was disconnected before the file was properly stored on the disk, it should have been "OK".

Do you know if the wallet.dat was encrypted with a password? If it wasn't, it might be possible to extract private keys "manually" by using a hex editor (or a script to scan the raw bytes of the file).

If it was encrypted, it's a lot more difficult.

[catLitter11]

I'm a little surprised that it is coming up as corrupted then... unless the drive is suffering from "bit rot", or the device was disconnected before the file was properly stored on the disk, it should have been "OK".

Do you know if the wallet.dat was encrypted with a password? If it wasn't, it might be possible to extract private keys "manually" by using a hex editor (or a script to scan the raw bytes of the file).

If it was encrypted, it's a lot more difficult.

I dont know if it is encrypted or not lol. Sorry it was from years ago.

[catLitter11]

I dont know if it is encrypted or not lol. Sorry it was from years ago.

Wallet encryption feature available since Bitcoin-Qt 0.4.0 (on 23 September 2011). Right click the wallet file and see when it's created and modified. If both have date/time before 23 September 2011, it's almost certainty NOT encrypted.

It's from 2016.

[HCP]

Well... you can try this script: https://github.com/HardCorePawn/dump_unenc_keys

Note that it requires Python 3.

Basically, it just hunts through the file looking for the old (unencrypted) private key marker and then dumps the next 32 bytes out as a private key and displays it on the screen. If the wallet.dat was unecrypted you might get lucky. Do you have any records of old bitcoin addresses so you can compare any extracted keys?

Alternatively... I have a script that can extract encrypted private keys, but I'm not sure how well they will work with a "corrupted" wallet.dat

To be difficult, this script requries Python 2 (it's untested with Python 3)... and obviously, you'd need to know the wallet password for it to work properly.