Recovering deleted wallet/files from HDD

[Ultegra134]

Not sure on where to post this, I apologize in advance if this isn't the correct section.

My laptop broke down this morning, taking my Bitcoin and Metamask wallet with it. Fortunately, I had both backed up so no losses there. Took it to a technician who claims that it's power unit or something is broken and it's not receiving power.

Anyway, back to the subject now, he's interested in purchasing it in case I do not want repair it, which is something I'm considering. However, my wallets are inside that laptop, someone who specializes in computers could potentially recover deleted files from the HDD.

I'm not sure if he wants to resell the laptop or he wants it for himself, my main concern though is that there's a way to recover deleted data. While I wouldn't really bother about the rest of my files, I'd rather not have someone recovering my wallets this way.

Is there an actual way to permanently delete such files from the HDD, forever?

[PawGo]

Yes, it is doable. You will need a program which in fact not "delete" files, but overwrites the whole disk with a new content - and do it several times.
Normal "delete" only removes information about file, but file stays on it's place. It is more like removing plate with your name from the front door - it does not mean you will disappear inside your flat

One of options: https://www.howtogeek.com/howto/15037/use-an-ubuntu-live-cd-to-securely-wipe-your-pcs-hard-drive/

BTW: Why not sell laptop without HDD?

[NeuroticFish]

Is there an actual way to permanently delete such files from the HDD, forever?

If the HDD is working, there are various software around that can overwrite existing files with garbage before removing them (wipe) and there are programs that can do similar stuff with the current free space on your HDD.
If you're under Windows I recommend SysInternals SDelete for the job, since SysInternals were bought by Microsoft many years ago, hence it should be safe.

I'd rather not have someone recovering my wallets this way.

If you want to super-sure and super-safe, why don't you just create brand new wallets and move your coins there?

[DaveF]

Yes you can easily recover most deleted files unless the drive has been properly wiped.
If he had access the the laptop out of your site he has access already to your wallet files.

Depending on the make / model of the laptop pulling the hard drive and putting it in a device that can read it takes less then 15 minutes.

If that is the case MOVE YOUR COINS NOW.
Create a new wallet securely on a different machine and move them.

This is why so many of us recommend hardware wallets. Take my laptop, get my wallet files, whatever I don't care. Without getting my hardware wallet it's worthless to someone.

-Dave

[LoyceV]

Took it to a technician who claims that it's power unit or something is broken and it's not receiving power.

Depending on the laptop this could be a cheap part to replace.

While I wouldn't really bother about the rest of my files, I'd rather not have someone recovering my wallets this way.

How about passwords? Creating a new wallet and moving all your coins is quite easy, but your browser might have access to many accounts too.

Is there an actual way to permanently delete such files from the HDD, forever?

There's a software shred and there's the hardware shredder.
I would prefer not to trust anyone with my data, so I would have removed the drive before sending the laptop to a repair guy.

[Ultegra134]

Firstly, I'd like to thank you for your replies, they mean a lot to me.

Took it to a technician who claims that it's power unit or something is broken and it's not receiving power.

Depending on the laptop this could be a cheap part to replace.

It's relatively cheap to replace, about €60 for both the replacement part and the labor. It's a refurbished laptop, not of too much value, but gets the job done.

While I wouldn't really bother about the rest of my files, I'd rather not have someone recovering my wallets this way.
How about passwords? Creating a new wallet and moving all your coins is quite easy, but your browser might have access to many accounts too.

That's right, that's something I forgot about, but the most important thing there is my wallets, therefore, I completely forgot about anything else but them.

Is there an actual way to permanently delete such files from the HDD, forever?
There's a software shred and there's the hardware shredder.
I would prefer not to trust anyone with my data, so I would have removed the drive before sending the laptop to a repair guy.

Stupid of me for not thinking it earlier, tomorrow is not a working day here and pretty much rushed to get it somewhere to get it fixed, since I used it for most of my daily and work stuff. He's a quite known and reputable guy, so I believe nothing will be done in the first place, I'll try not to be paranoid about it. Definitely took my lesson in case something like this ever happens again.

If I'm to sell it, I'll either replace the HDD with an old one I have here or use one of the recommended software to overwrite the files.

[LoyceV]

I'll try not to be paranoid about it.

For what it's worth: I do try to be paranoid about my Bitcoin security. As they say: "Just because you're paranoid doesn't mean they aren't after you."

[dkbit98]

Is there an actual way to permanently delete such files from the HDD, forever?

You could just sell him your laptop without HDD, just open it and remove the drive yourself, that would be the safest way and nobody would be able get your keys.

Other option is to fully format your hard drive, but since your laptop is still at technician I would move all your coins to new addresses that you fully control, without any connection with keys on that laptop.

[Ultegra134]

I'll try not to be paranoid about it.

For what it's worth: I do try to be paranoid about my Bitcoin security. As they say: "Just because you're paranoid doesn't mean they aren't after you."

I can definitely see why. On top of that, I wasn't exactly sure on where I had backed up my Metamask wallet, and until I found my seed phrase, I almost collapsed to the thought of losing my funds. Since it's based on Chrome, I'll have to physically boot the HDD in order to run Chrome and export the private keys/seed phrase. All thoughts crossed to my mind, from a corrupted HDD, to a stuck BIOS etc., it haunted me.

Is there an actual way to permanently delete such files from the HDD, forever?

You could just sell him your laptop without HDD, just open it and remove the drive yourself, that would be the safest way and nobody would be able get your keys.

Other option is to fully format your hard drive, but since your laptop is still at technician I would move all your coins to new addresses that you fully control, without any connection with keys on that laptop.

I'll get it back on Friday, if everything goes according to plan, if it's working fine, I might sell it without the HDD, it will also save me the time to back up my files and overwrite it.

[Stalker22]

I'll try not to be paranoid about it.

For what it's worth: I do try to be paranoid about my Bitcoin security. As they say: "Just because you're paranoid doesn't mean they aren't after you."

I can definitely see why. On top of that, I wasn't exactly sure on where I had backed up my Metamask wallet, and until I found my seed phrase, I almost collapsed to the thought of losing my funds. Since it's based on Chrome, I'll have to physically boot the HDD in order to run Chrome and export the private keys/seed phrase. All thoughts crossed to my mind, from a corrupted HDD, to a stuck BIOS etc., it haunted me.

So you have a backup seed phrase or not? If you do, I recommend restoring your wallet on a new device and moving your coins as soon as possible to a new wallet. Unless your wallet is password protected, your funds are not safe even from your technician (I'm not saying to doubt a man, I'm just saying he's not responsible for your data).

[Ultegra134]

I'll try not to be paranoid about it.

For what it's worth: I do try to be paranoid about my Bitcoin security. As they say: "Just because you're paranoid doesn't mean they aren't after you."

I can definitely see why. On top of that, I wasn't exactly sure on where I had backed up my Metamask wallet, and until I found my seed phrase, I almost collapsed to the thought of losing my funds. Since it's based on Chrome, I'll have to physically boot the HDD in order to run Chrome and export the private keys/seed phrase. All thoughts crossed to my mind, from a corrupted HDD, to a stuck BIOS etc., it haunted me.

So you have a backup seed phrase or not? If you do, I recommend restoring your wallet on a new device and moving your coins as soon as possible to a new wallet. Unless your wallet is password protected, your funds are not safe even from your technician (I'm not saying to doubt a man, I'm just saying he's not responsible for your data).

I do, I've successfully recovered both wallets (Electrum and Metamask) and they are up and running on another computer. Even if data loss is presented, both wallets are fine, however, my only concern would be the technician to snoop through my files, which may sound too paranoid (or not, you never know).

[BitMaxz]

That's the problem that I don't like sending my PC to a repair shop with my assets is pretty risky. Even you trust the technician it is still risky.
There are lots of guides and tutorials on Youtube and Google if you have a problem with your PC because mine I learned a lot on youtube and apply what I learned to repair my own Laptop/PC.


I have a few HDD and SSD with the corrupted OS but a few of my wallets are still there but I can still extract them out from corrupted HDD/SSD and never use them again I just put them near on my table but never put it back alive on my PC.  It's more likely an SSD/HDD backup for future recovery if needed.
It's way more safety than sending your own personal PC/Laptop to anyone and researching and learning on Youtube/Google doesn't cost you anything other than sending it to the technician.

[nc50lc]

"Zero Fill" is the term you might be looking for. Some call it "Full Overwrite".
It's a complete wipe where all the data is rewritten into '0' compared to "format" that'll just delete the partition or file system but leave the other data untouched.

Depending on your Disk's manufacturer, there are official tools that can perform 'zero fill' like:
"SeaTools" from Seagate for Seagate HDD | "Western Digital SSD Dashboard" for WD SSD's.
So check for your HDD/SSD's manufacturer's website for Disk tools.

[larry_vw_1955]

My laptop broke down this morning, taking my Bitcoin and Metamask wallet with it. Fortunately, I had both backed up so no losses there. Took it to a technician who claims that it's power unit or something is broken and it's not receiving power.

that was the first security blunder right there.  once you hand it off to somebody, you can't really say "once i get it back, ..."

[ABCbits]

I do, I've successfully recovered both wallets (Electrum and Metamask) and they are up and running on another computer.

Just confirming, did you only enter the seed phrase or also move the coin to newly generated wallet? If you did the former and the technician have malicious intent, he/she/they still could steal the coin.

Even if data loss is presented, both wallets are fine, however, my only concern would be the technician to snoop through my files, which may sound too paranoid (or not, you never know).

Without knowing technician history or license, your concern is normal.

[Lucius]

I personally don't sell my old cell phones or computers, I don't even throw them in the trash - not only to prevent anyone from getting any data, but also because one day all these old devices will be a good reminder of how technology has evolved over time. In case someone still wants to sell an old computer, I wouldn't risk deleting the files - just take out the HDD/SSD and sell it that way.

I do, I've successfully recovered both wallets (Electrum and Metamask) and they are up and running on another computer. Even if data loss is presented, both wallets are fine, however, my only concern would be the technician to snoop through my files, which may sound too paranoid (or not, you never know).

I would just in case transfer everything to new wallets, no matter how much you believe or not that person who did the diagnostics on your computer. Although we all think that such people keep their reputation and will not do anything bad that would endanger it, sometimes it is hard to resist not peeking into other people's secrets if you already have the opportunity.

[Ultegra134]

I do, I've successfully recovered both wallets (Electrum and Metamask) and they are up and running on another computer.

Just confirming, did you only enter the seed phrase or also move the coin to newly generated wallet? If you did the former and the technician have malicious intent, he/she/they still could steal the coin.

Even if data loss is presented, both wallets are fine, however, my only concern would be the technician to snoop through my files, which may sound too paranoid (or not, you never know).

Without knowing technician history or license, your concern is normal.

I only recovered my wallets through the 12 word seed phrase. I haven't moved my funds to a new wallet.

I personally don't sell my old cell phones or computers, I don't even throw them in the trash - not only to prevent anyone from getting any data, but also because one day all these old devices will be a good reminder of how technology has evolved over time. In case someone still wants to sell an old computer, I wouldn't risk deleting the files - just take out the HDD/SSD and sell it that way.

I do, I've successfully recovered both wallets (Electrum and Metamask) and they are up and running on another computer. Even if data loss is presented, both wallets are fine, however, my only concern would be the technician to snoop through my files, which may sound too paranoid (or not, you never know).

I would just in case transfer everything to new wallets, no matter how much you believe or not that person who did the diagnostics on your computer. Although we all think that such people keep their reputation and will not do anything bad that would endanger it, sometimes it is hard to resist not peeking into other people's secrets if you already have the opportunity.

Yeah, I'll move everything to new wallets just in case, you can never be safe enough. On top of that, if we suppose that he has snooped through my files, he could potentially try to compromise the wallets at a much later date. That way, no accusation can actually be directed to him.

[NotATether]

One of options: https://www.howtogeek.com/howto/15037/use-an-ubuntu-live-cd-to-securely-wipe-your-pcs-hard-drive/

He can just ask the technician to put the hard disk in an external enclosure first and run something like Recuva to overwrite the hard disk with random bytes first so that the data is unrecoverable (there's a particular 38-pass military-grade algo that I like as it is very secure).

[figliar0]

Pesonally I never put my computers to someone else, I do repairs myself. If you cannot repair computer, just put it to technician without drive, that is totally OK.

If you want to sell or throw away computer, I definitelly recommend to wipe drive (or destroy it). Some live linux distribution is the best for that, because system is only in RAM and whole drive can be securelly wiped. If you are not friend with linux commands, I can recommend Parted Magic, which have GUI tool to do the thing, but you have to pay for it. But you can wipe drive with (almost) any distro.

I do the wipe in two steps:

• write zeroes to whole drive,
• apply ATA/NVME secure erase command.

It is useful to do both, because regular zeroing do not overwrite backup sectors and are not very efective on flash devices in general (because of various techniques of physical sector abstraction like wear leveling). On other hand secure erase command may not be properly implemented in firmware of the drive.

Forget about some many-many-pass total-random-pattern algorithms - those are useless and time consuming. I don't trust to zeroing only empty space from running OS, nor even wiping single file - various snapshots, shadow copies, backups, hardlinks, etc prevent to do this trustworthy (and do not forget for backup sectors and firmware sector abstraction mechanisms on flash devices).

[Ultegra134]

Thank you for all the replies, made me realize how cautious we need to be when dealing with personal files, whether that has to do with wallets/money or simply passwords and any sensitive data.

Just got my laptop back, which has an integrated keylogger as well, I see that he hasn't snooped into Chrome at least, can never be too sure about the rest of the hard drive. Anyway, I'm going to move all my funds into new wallets, just in case, it doesn't cost me much in either time or money, so I don't see why not be on the safe side.

Thanks again for all the advice, I really appreciate it.