Need help and advice regarding recovery

[ph1980]

Hello,

I'm aware the forum is probably awash with these type of posts, so i sincerley apologise for another. i've spent a few weeks trying to possibly recover bitcoin wallet from mining in 2009 but hit a dead end, so i've come to ask for advice.

So to explain, I mined bitcoin propbably early 2009 for roughly 2 months, before thinking it was not really worth leaving the pc on and called it a day. This was on an old pentium 4 pc desktop, nothing great. I left the country oct 09 and left my PC with my friend and said he could use it until i returned. Upon returning 2011, he had wiped windows xp and put on win7 OS.

I got the pc back, but it packed in and i never used it again.

I never had any interest in cryptocurrency until last year, and recently saw a thread on reddit explaining that even with a formatted drive, that it's possible to recover deleted bitcoin wallet.

So i got the old hdd out and bought a sata 3 caddy.

Then as i read was advisable , i cloned the HDD booting my windows laptop into a Linux ubuntu usb boot key.

I used ddrescue and saved the cloned drive image to an external.

I have searched for wallet.dat and don't see anything from a standard search or browsing to app data. I think i need to recover the deleted xp formatted part. If this is not possible and it's simply gone and it's toast, then fine, i just move on.

I managed to figure out how to run testdisk and found lot's of deleted stuff but so much came back i had no idea what to do with it all next.

Then i tried to follow the instructions from this thread to use keyhunter.py https://bitcointalk.org/index.php?topic=2857580.0 .....but this is where i am stuck, i do not know Linux, nor am i good technically with computer code like this...So i couldn't get it to work.

I mounted the cloned hdd image, but no idea how to use keyhunter.py it said to make it executable - no idea.

Then i went back to windows 10, cloned the hdd once again using EaseUS software ( windows wouldnt open the Linux created image file), mounted it which created it as Local drive (Z)

Then i ran R-studio and followed this guide https://www.disktuna.com/recover-lost-or-deleted-bitcoin-wallet-dat-using-r-studio/

The script wallet.ini filled raw data files as suggested to use in that guide came back with various wallet folders with a total of 39 dat files - probably nothing looking at it, none were marked wallet.dat. I still haven't recovered any potential formatted data though.

Edit **the search using wallet.ini that came back with 39 files - i used a program called DMDE.

So is this just toast and chasing btc ghosts or is there something else i could do ?

Cheers

[PawGo]

Then as i read was advisable , i cloned the HDD booting my windows laptop into a Linux ubuntu usb boot key.

Depending on your Windows version (10?) You may use WSL, to have easily "two" systems, and launch linux as a any other program. Maybe it would make your life a little easier. Then you may see your mounted/external disk in WSL and use linux tools.
Were you able to restore any folders structure? What you see are probably program file, not saved wallet.
Did you try pywallet or not yet?
https://bitcointalk.org/index.php?topic=38004.0

[ph1980]

Then as i read was advisable , i cloned the HDD booting my windows laptop into a Linux ubuntu usb boot key.

Depending on your Windows version (10?) You may use WSL, to have easily "two" systems, and launch linux as a any other program. Maybe it would make your life a little easier. Then you may see your mounted/external disk in WSL and use linux tools.
Were you able to restore any folders structure? What you see are probably program file, not saved wallet.
Did you try pywallet or not yet?
https://bitcointalk.org/index.php?topic=38004.0

Hi, Yes i am running Windows 10. What is WSL , is it like a dual boot thing ? No i have not restored any folder structures, i ran Testdisk, r-studio - which came back with deleted sections but i didn't recover them as was unsure what to bother with. Also ran DMDE using the search for wallet.ini, but as you say likely program file.

Not tried pywallet.....I installed python 2.7 on my c drive . How do i run it , just command line ? and say if the mounted disk is Local disk (z) how do i get it to target that cloned image ?

Cheers

[PawGo]

Hi, Yes i am running Windows 10. What is WSL , is it like a dual boot thing ?

No, it is rather "subsystem", which you just launch like any other program.
https://docs.microsoft.com/en-us/windows/wsl/install
Or just download Ubuntu or Debian from the Store.

Not tried pywallet.....I installed python 2.7 on my c drive . How do i run it , just command line ? and say if the mounted disk is Local disk (z) how do i get it to target that cloned image ?

If you launch it from inside of WSL, you will have your drives under /mnt folder, like "/mnt/c/...."(it will be probably "--recov_device /mnt/z")
If you boot your machine into pure linux, it will appear somewhere under /dev/ folder.

[NeuroticFish]

I am inexperienced on recovering your wallet, however, some basics:

1. WSL is a tool you install on Windows 10, tool which allows you run a Linux (you have to install from Microsoft Store) like you'd run any other Windows application (or console application).
2. I may be wrong, but cloning has a pretty good chance to completely miss the clusters marked as deleted or, even more, from a previous partitioning or formatting. Keep this in mind.
3. I think that best would be to get a HDD or SSD (different from the disk you have the valuable data on, but I guess that you already know you should not write absolutely anything onto the valuable disk) you install Linux onto it and run everything under pure Linux (no WSL) and then work on reading all the clusters of the other disk (I don't know with which tool) and scan them for useful data. The valuable HDD will probably stay either as USB disk, either as a secondary HDD.

[ph1980]

Ok thanks guys, i will look into WSL that sounds a lot better to figure out. Yes i was wondering which cloning software  will pick up all deleted data and not worry about missing sections. As i say, some software has picked up deleted data, it's just messy to look at so i'm not too sure. If i figure out pywallet and it comes back with nothing then maybe best put it to bed and accept it's gone.

[jackg]

If i figure out pywallet and it comes back with nothing then maybe best put it to bed and accept it's gone.

You could just give up and come back to it if it's not fun or you can't be bothered doing it. Once you've got a disk image, your files are safe and can be recovered later on anyway if you get motivation to come back to it/get bored.




I don't know how useful this is but you might want to look at installing software like autopsy which should be able to sort things in a time wise format (from a disk image) - presumably your wallet.dat file could then be found by looking at things of a similar timeframe (but I'm not sure on how the filesystem in XP worked).

Also I don't think bitcoin core had encryption back in 2009 so you could attempt to search to your disk for strings of data the wallet file would have saved (but I've not seen an example of one from that long ago so I'm not sure how they would have been).

[PawGo]

Also I don't think bitcoin core had encryption back in 2009 so you could attempt to search to your disk for strings of data the wallet file would have saved (but I've not seen an example of one from that long ago so I'm not sure how they would have been).

Some say it should be (hex value):

Code:

fd1701308201130201010420

or shorter version, for example:

Code:

201010420

Then the next bytes should be your private key.

About making copy: did you consider using linux tool 'dd' to make disk image? It seems it would copy all.

If you may read in the same language as Molière (or just want to use google translate), take a look there:
https://www.radjaidjah.org/index.php?post/2014/09/07/Sauver-ses-bitcoins-de-la-corruption

[ph1980]

I've got Winhex downloaded and i did a search the other day for 0420 and  it came back with results but i read this is common to find. I didnt know about the other hex to search like the ones you've added , so i will try them.

I used ddrescue to create a disk image of the hdd on Linux.  i think i will look at your suggestion. Simply because i'm not sure if the Windows software is including everything. I ran Testdisk, Dmde, recuva and r-studio and they all find different deleted files, quite impressive really but i need to search for the wallet - need to get those python scripts working..I'm literally looking through folders one by one.

I did find bitminter client and username details to which i contacted their email support - its no longer running. Was good enough to reply to inform me it was just dust, i dont even remember running it so sounds right.😁


 cheers for everyones input.

[ph1980]

Not tried pywallet.....I installed python 2.7 on my c drive . How do i run it , just command line ? and say if the mounted disk is Local disk (z) how do i get it to target that cloned image ?

If you launch it from inside of WSL, you will have your drives under /mnt folder, like "/mnt/c/...."(it will be probably "--recov_device /mnt/z")
If you boot your machine into pure linux, it will appear somewhere under /dev/ folder.


[/quote]

I've tried to run pywallet but really struggling.

I downloaded the file into downloads it auto ran the installation - created files in c: program files 86x\  GnuWin32 folder it also created a pywallet bat file which it dumped into downloads where the auto zip file was. Ran the install bat.

Opened win + R CMD

Typed  cd C:\Users\'name'\downloads\ pywallet

it comes back to say
The system cannot find the path specified.

This is melting my mind 

[ph1980]

I've tried to run pywallet but really struggling.

I downloaded the file into downloads it auto ran the installation

Just wondering, where did you download pywallet? AFAIK there's no option to install pywallet.

Opened win + R CMD

Typed  cd C:\Users\'name'\downloads\ pywallet

it comes back to say
The system cannot find the path specified.

At least for this error, it's likely you write the folder name incorrectly. Have you tried cd one folder at a time?

Code:

cd Downloads
cd pywallet

i found it through this old thread, 10 posts down.

https://bitcointalk.org/index.php?topic=2398504.0

[ABCbits]

Just wondering, where did you download pywallet? AFAIK there's no option to install pywallet.

i found it through this old thread, 10 posts down.

https://bitcointalk.org/index.php?topic=2398504.0

I understand what you meant. To be precise, it extract all files and install required software (such as Python). I just tried "PWI_0.0.3.exe" on Windows 10, but i encountered problem and it quit hallway. But i managed to run pywallet on Windows (after i check install script and other user post). Here's what i did,

1. Download and install Python from https://www.python.org/downloads/release/python-2716/. I choose "Windows x86-64 MSI installer". Make sure you enable "Add python.exe" to the path.



2. Download pywallet from https://raw.githubusercontent.com/jackjack-jj/pywallet/b52c955f8c93a75745166ebf281448016e1f22e2/pywallet.py. I right clicked the page and save it at Desktop. On your Desktop, you should see "pywallet.dat" file.
3. Open CMD and run this

Code:

cd Desktop
pip install twisted
python pywallet.py --web --port 8989

4. Open your browser and enter localhost:8989. Afterwards you should see something like this.



P.S. Sorry for rough explanation, i rarely use windows for this kind of stuff. I also never use web version either.

[ph1980]

Just wondering, where did you download pywallet? AFAIK there's no option to install pywallet.

i found it through this old thread, 10 posts down.

https://bitcointalk.org/index.php?topic=2398504.0

I understand what you meant. To be precise, it extract all files and install required software (such as Python). I just tried "PWI_0.0.3.exe" on Windows 10, but i encountered problem and it quit hallway. But i managed to run pywallet on Windows (after i check install script and other user post). Here's what i did,

1. Download and install Python from https://www.python.org/downloads/release/python-2716/. I choose "Windows x86-64 MSI installer". Make sure you enable "Add python.exe" to the path.

https://i.ibb.co/ZmcRQfh/b.png

2. Download pywallet from https://raw.githubusercontent.com/jackjack-jj/pywallet/b52c955f8c93a75745166ebf281448016e1f22e2/pywallet.py. I right clicked the page and save it at Desktop. On your Desktop, you should see "pywallet.dat" file.
3. Open CMD and run this

Code:

cd Desktop
pip install twisted
python pywallet.py --web --port 8989

4. Open your browser and enter localhost:8989. Afterwards you should see something like this.

https://i.ibb.co/mzXxK79/a.png

P.S. Sorry for rough explanation, i rarely use windows for this kind of stuff. I also never use web version either.

Thanks a lot for this guide, very good. I will have a crack at it this week. I will also go back to Linux and try as suggested - making a clone using DD and try to work it that way. It is all beyond me this stuff, bit too technical but willing to try and at least put any doubts to rest by exhausting every avenue of search. All i know is at the time i was running SETI (search for extra terrestrial intelligence) - crunching data & i ran bitcoin to mine in the background alternatively, it was in 2009 as i left the country later that year. If it's gone it's gone, game over. Appreciate all the replies 
Cheers

[HCP]

Honestly, I don't really fancy your chances... an XP machine that was reformatted to Win7 and then "used" for up to 2 years afterwards?

Also... that browser based version of PyWallet isn't really suitable for disk/image scanning for wallet files... it was more as a utility for working directly with known wallet.dat files.

If you're trying to scan the disk/image for possible files... you'll need to use the command line version.

[NotATether]

Honestly, I don't really fancy your chances... an XP machine that was reformatted to Win7 and then "used" for up to 2 years afterwards?

Particularly if the friend nearly filled up the hard disk with data, or maybe even half of the hard disk. In those cases, the wallet bytes won't even be on the raw image, and you'd have to use some specialized tools to see if you can read the original (unencrypted) bytes.

[BatuhanZ]

It's not the formatting that matters. how long was it used after format ?
I am a software developer since 2001. I have recovered such data and wallet before. But every case is different.
if you want private help pm or reply me.

I hope you find it. Good luck

[NeuroticFish]

if you want private help pm or reply me.

I will not say OP should avoid this kind of offers, but I will say to be extremely cautious, since in most cases this kind of offers can easily lead to stolen data and stolen money.
Especially newbie accounts have nothing to lose (reputation doesn't matter for them).

@BatuhanZ, why don't you try to help him publicly if your intentions are good?

[BitMaxz]

this is true. Absolutely I agree...  Trusting is important. I need information so I can help. How will I get this information ?
I think private scanning software with python for this or try another method, i need check i need look , i need test more test ? How ? He will come my house ? How is it going to be. That is the law of this universe.

I want help but this is very hard progress in here ...

Best Regards.

Why don't you just guide him instead?

For me, you don't need to check and look and test the owner can able to do this and tell you what it looks like and the information you need if it isn't risky then the owner can share it publicly here except for important data it shouldn't be shared here or to you.

About how then why? Why would he come to your house? Unless you are trusted he can able to go there but if not, that's risky.

[BatuhanZ]

this is true. Absolutely I agree...  Trusting is important. I need information so I can help. How will I get this information ?
I think private scanning software with python for this or try another method, i need check i need look , i need test more test ? How ? He will come my house ? How is it going to be. That is the law of this universe.

I want help but this is very hard progress in here ...

Best Regards.

Why don't you just guide him instead?

For me, you don't need to check and look and test the owner can able to do this and tell you what it looks like and the information you need if it isn't risky then the owner can share it publicly here except for important data it shouldn't be shared here or to you.

About how then why? Why would he come to your house? Unless you are trusted he can able to go there but if not, that's risky.

25 year experience. im 45 years old. Developing software is easy. It is difficult to detect.
You are right too. I will write what to do.

Step 1 : You need detect fat system for sector scannig. Fat12/16/32 bla bla. If ntfs its hard because it has an authorization system. Found !!!  the file does not mean accessing it.
Step 2 : How long it was used after format. Fat system is changed ? Which sectors were rebuilt ? or Which sectors were owerwrite ?
Step 3 : Is there a partition ? if yes you remember partition location for your data ? If your data on second or third partition your chances are higher.
Step 4 : After the determinations are made, the appropriate tool or software should be found and the audit should be started.

You dont know python or c++ i recomended "Deep Scan" tools from Easeus Software for you. Dont forget you need sector based scan. Not partition or not another.
if you want help write here please

[ph1980]

Honestly, I don't really fancy your chances... an XP machine that was reformatted to Win7 and then "used" for up to 2 years afterwards?

Also... that browser based version of PyWallet isn't really suitable for disk/image scanning for wallet files... it was more as a utility for working directly with known wallet.dat files.

If you're trying to scan the disk/image for possible files... you'll need to use the command line version.

Late replying back to this thread, been away with temp illness.

Yeah think you're right tbh. Chances look dead. The PC was used about this long after reformatting before the motherboard/cpu or whatever failed and i never bothered with it again.