Recover btc old pc - Unistalled Client back in 2010

[rosnick92]

Hello everyone, I found my old pc I used to mine bitcoin around 2009/2010. I already read several topics about the way to try to recover the wallet but I'm having issues.

Specifically for one detail: after a few days of mining, noticing that the profit was few pennies per day (lol), I gave up on the idea and unistalled the client (I think).
After the unistall process, the pc was being used i'd say for another couple years (might be useful to know for the search of deleted files).


Since back then i was using both this pc but also my dad's laptops, and since it was more than 10 years ago, I'm just going by memory. Here's all I know:


- I mined btc for a few days and i was making few pennies per day.
- I think i unistalled the client due to the size of the blockchain you had to download to run the client.
- I didnt do any backup
- I have no bitcoin folder in the appdata folder

Unistalling the bitcoin client (which means i have no bitcoin folder inside appdata folder) makes the whole recovery process impossible?
Is there any way to check if the bitcoin client was indeed installed on any of the hd I have (both pc and laptops)? So i can narrow the research to the one hd that matters(I checked in all hard drives inside the appdata folder)?

I found and tried the keyhunter phython script but it gives me syntax error (windows 10 python 3 and i also tried with python 2.7.3)

I tried hexworkshop and searched for the "magic bytes" but couldnt find anything.

Please I need some answers so at least i can let this whole thing go for good.

[1715234409]

1715234409

[1715234409]

1715234409

[1715234409]

1715234409

[Charles-Tim]

You do not have the private key to the address used and also you did not have the wallet.dat. which means all possible means you need to recover your coin you thought to be nothing in the past but now something of value has not been in place by which in the past, and now you want to recover it back. You need your private key or wallet.dat is all that I know

[rosnick92]

You do not have the private key to the address used and also you did not have the wallet.dat. which means all possible means you need to recover your coin you thought to be nothing in the past but now something of value has not been in place by which in the past, and now you want to recover it back. You need your private key or wallet.dat is all that I know

Yes, I'm asking if I'm still in the position to recover the private key or the wallet.dat given my circumstances.

[NeuroticFish]

Unistalling the bitcoin client (which means i have no bitcoin folder inside appdata folder) makes the whole recovery process impossible?

No. But the fact you've used that PC for so many years can easily mean that the removed data was also overwritten, hence it has become unrecoverable forever.

I tried hexworkshop and searched for the "magic bytes" but couldnt find anything.

In theory, if the disk was re-partitioned (for example for fresh Win10), there may be areas now used by other partitions, for example, that could have useful data. But I am not a specialist and I may be wrong (and scammers can pretend to be specialists and give you false hopes in order to try to scam you, so be overly careful and keep your expectations low).


------------
Something more: I've seen in your post history that in 2017 you were interested in an altcoin. Please also make sure you're not mixing up things, since I don't think that the altcoin worth the effort.

[rosnick92]

Unistalling the bitcoin client (which means i have no bitcoin folder inside appdata folder) makes the whole recovery process impossible?

No. But the fact you've used that PC for so many years can easily mean that the removed data was also overwritten, hence it has become unrecoverable forever.

I tried hexworkshop and searched for the "magic bytes" but couldnt find anything.

In theory, if the disk was re-partitioned (for example for fresh Win10), there may be areas now used by other partitions, for example, that could have useful data. But I am not a specialist and I may be wrong (and scammers can pretend to be specialists and give you false hopes in order to try to scam you, so be overly careful and keep your expectations low).


------------
Something more: I've seen in your post history that in 2017 you were interested in an altcoin. Please also make sure you're not mixing up things, since I don't think that the altcoin worth the effort.

About the altcoin, no I?m not mixing up because I remember mining on my dad's pc because I didnt have one for myself until 2011 when I went to university. So the range is 2009 up to sept 2010. I remember I was making few pennies per day so i could be 1/3 btc if i mined in 2010 or maybe 50/100 if i mined in the 2009. But i dont remember anything other than "few pennies per day"

No partition because the pc hasn't been used for years after the 2011. It still has windows xp.


I would like to find someone to explain me how to use the keyhunter.py script since I have no coding knowledge. I did an image disk of the hard drive to avoid more data corruption but then I simply can't make the script work.

What I did was to download python 3, I run cmd in the image disk folder(first question which folder? I have windowsImagebackup>desktop-name>backup2022-07-28 which folder to put the keyhunter in?) installed pyinstaller with "pip install pyinstaller", made keyhunter executable with "pyinstaller --onefile keyhunter.py" then run the script with "python keyhunter.py" and it says syntax error for missing ()

I saw the same issue in the keyhunter github saying you need to use python 2.7.3. I did that but same thing.

[BitMaxz]

I saw the same issue in the keyhunter github saying you need to use python 2.7.3. I did that but same thing.

How about a lower version like the exact python version 2.7? Here's the link https://www.python.org/downloads/release/python-270/

I can't find much about this recovery tool but it looks like it can recover private keys from accidentally deleting the wallet.dat.

Would you mind trying if you have an extra laptop or PC install windows 7 OS and then install python 2.7(Only do this if you still have a syntax error) to make sure keyhunter will work then put the image disk backup on that PC and try to recover it or make the HDD as your external and then run keyhunter.

[nc50lc]

You can also try pywallet's --recover tool: https://github.com/jackjack-jj/pywallet
It works just like keyhunter, it will try to restore deleted keys/wallet from the selected drive.

Here's an example command for recover (tested with python v2.7.17 and latest version of pywallet):

Code:

python pywallet.py --recover --recov_device=D: --recov_size=50Gio --recov_outputdir=C:\pywallet_recov_dir

Then you'll be prompted for the to-be-created wallet's passphrase (where the keys will be imported) and the deleted wallets'/keys' possible passphrases.
(characters wont display as you type the passphrases)

The result will be a wallet.dat named "recovered_wallet_<number>.dat" that you can load to Bitcoin Core.

[rosnick92]

You can also try pywallet's --recover tool: https://github.com/jackjack-jj/pywallet
It works just like keyhunter, it will try to restore deleted keys/wallet from the selected drive.

Here's an example command for recover (tested with python v2.7.17 and latest version of pywallet):

Code:

python pywallet.py --recover --recov_device=D: --recov_size=50Gio --recov_outputdir=C:\pywallet_recov_dir

Then you'll be prompted for the to-be-created wallet's passphrase (where the keys will be imported) and the deleted wallets'/keys' possible passphrases.
(characters wont display as you type the passphrases)

The result will be a wallet.dat named "recovered_wallet_<number>.dat" that you can load to Bitcoin Core.

I downloaded from the website and installed python 2.7 but cmd says that "Python was not found; run without arguments to install from the Microsoft Store, or disable this shortcut from Settings > Manage App Execution Aliases."

On python 3+ i noticed there was a option to install python path or something like that. Is that related?

Also regarding the pywallet.py script, I would love if you could give me a step by step guide on how to use it. For instance I read that I shouldn't use the original hd but use an image disk. But I have no idea how to do that. I created an image disk of that hd I think
 I have windowsImagebackup>desktop-name>backup2022-07-28

[rosnick92]

I saw the same issue in the keyhunter github saying you need to use python 2.7.3. I did that but same thing.

How about a lower version like the exact python version 2.7? Here's the link https://www.python.org/downloads/release/python-270/

I can't find much about this recovery tool but it looks like it can recover private keys from accidentally deleting the wallet.dat.

Would you mind trying if you have an extra laptop or PC install windows 7 OS and then install python 2.7(Only do this if you still have a syntax error) to make sure keyhunter will work then put the image disk backup on that PC and try to recover it or make the HDD as your external and then run keyhunter.

I found this keyhunter script on this thread https://bitcointalk.org/index.php?topic=2857580.0

I'm already using another windows 7 pc for this. I took the hd from the old pc and mounted in a new win7 pc as second hd.

[nc50lc]

Also regarding the pywallet.py script, I would love if you could give me a step by step guide on how to use it.

First of all, you should be working on another PC with its own system disk and just mount a clone of the drive where your deleted wallet/keys are.
Writing or installing anything on it can potentially overwrite the very data that you want to restore, including using it as a system disk.

About cloning the drive, I don't have anything to recommend for Windows, I also don't know if Windows' "System Image" is a clone of the whole drive.
If you can restore your Windows Image Backup to another HDD/SSD, do it and try to use that restored copy instead.
---------

After that, download and extract pywallet.py into the same folder where python.exe is located.
Then you can use it without installing anything aside from python v2.x.

The example command in my first post should work but you should change the parameters based from your drive and directory paths and size.

-snip-

I downloaded from the website and installed python 2.7 but cmd says that "Python was not found; run without arguments to install from the Microsoft Store, or disable this shortcut from Settings > Manage App Execution Aliases."

You can launch python from its install directory by using command prompt's "cd" (change directory) command.

Example: if python is installed in "C:/Python/Python27" and python.exe is in that directory, you can enter: cd "C:/Python/Python27"
to set it as command prompt's working directory, then the python command should now work in that session.

[rosnick92]

Also regarding the pywallet.py script, I would love if you could give me a step by step guide on how to use it.

First of all, you should be working on another PC with its own system disk and just mount a clone of the drive where your deleted wallet/keys are.
Writing or installing anything on it can potentially overwrite the very data that you want to restore, including using it as a system disk.

About cloning the drive, I don't have anything to recommend for Windows, I also don't know if Windows' "System Image" is a clone of the whole drive.
If you can restore your Windows Image Backup to another HDD/SSD, do it and try to use that restored copy instead.
---------

After that, download and extract pywallet.py into the same folder where python.exe is located.
Then you can use it without installing anything aside from python v2.x.

The example command in my first post should work but you should change the parameters based from your drive and directory paths and size.

-snip-

I downloaded from the website and installed python 2.7 but cmd says that "Python was not found; run without arguments to install from the Microsoft Store, or disable this shortcut from Settings > Manage App Execution Aliases."

You can launch python from its install directory by using command prompt's "cd" (change directory) command.

Example: if python is installed in "C:/Python/Python27" and python.exe is in that directory, you can enter: cd "C:/Python/Python27"
to set it as command prompt's working directory, then the python command should now work in that session.

Thank you, python works following your steps and the pywallet.py runs too. I have last 2 questions about the script. This is what I did so far:

Code:

 C:\Python27>python pywallet.py
WARNING:root:pycrypto or libssl not found, decryption may be slow
Warning: 'ecdsa' package is not installed, so you won't be able to sign/verify messages but everything else will work fine
A mandatory option is missing

Usage: pywallet.py [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  --dump_bip32=DUMP_BIP32
                        dump the keys from a xpriv and a path, usage:
                        --dump_bip32 xprv9s21ZrQH143K m/0H/1-2/2H/2-4
  --bip32_format=BIP32_FORMAT
                        format of dumped bip32 keys
  --passphrase=PASSPHRASE
                        passphrase for the encrypted wallet
  --find_address=FIND_ADDRESS
                        find info about an address
  -d, --dumpwallet      dump wallet in json format
  --dumpformat=DUMPFORMAT
                        choose what to extract in a wallet dump
  --dumpwithbalance     includes balance of each address in the json dump,
                        takes about 2 minutes per 100 addresses
  --importprivkey=KEY   import private key from vanitygen
  --importhex           DEPRECATED, useless
  --datadir=DATADIR     REMOVED OPTION: put full path in the --wallet option
  -w WALLETFILE, --wallet=WALLETFILE
                        wallet filename (defaults to wallet.dat)
  --label=LABEL         label shown in the adress book (defaults to '')
  --testnet             use testnet subdirectory and address type
  --namecoin            use namecoin address type
  --eth                 use ethereum address type
  --otherversion=OTHERVERSION
                        use other network address type, either P2PKH prefix
                        only (e.g. 111) or full network info as
                        'name,p2pkh,p2sh,wif,segwithrp' (e.g. btc,0,0,0x80,bc)
  --info                display pubkey, privkey (both depending on the
                        network) and hexkey
  --reserve             import as a reserve key, i.e. it won't show in the
                        adress book
  --multidelete=MULTIDELETE
                        deletes data in your wallet, according to the file
                        provided
  --balance=KEY_BALANCE
                        prints balance of KEY_BALANCE
  --recover             recover your deleted keys, use with recov_size and
                        recov_device
  --recov_device=RECOV_DEVICE
                        device to read (e.g. /dev/sda1 or E: or a file)
  --recov_size=RECOV_SIZE
                        number of bytes to read (e.g. 20Mo or 50Gio)
  --recov_outputdir=RECOV_OUTPUTDIR
                        output directory where the recovered wallet will be
                        put
  --clone_watchonly_from=CLONE_WATCHONLY_FROM
                        path of the original wallet
  --clone_watchonly_to=CLONE_WATCHONLY_TO
                        path of the resulting watch-only wallet
  --dont_check_walletversion
                        don't check if wallet version > 81000 before running
                        (WARNING: this may break your wallet, be sure you know
                        what you do)
  --random_key          print info of a randomly generated private key
  --whitepaper          write the Bitcoin whitepaper using bitcoin-cli or
                        blockchain.info
  --minimal_encrypted_copy
                        write a copy of an encrypted wallet with only an empty
                        address, *should* be safe to share when needing help
                        bruteforcing the password
  --tests               run tests

C:\Python27> 

Is it working properly?

Code:

python pywallet.py --recover --recov_device=D: --recov_size=50Gio --recov_outputdir=C:\pywallet_recov_dir

I copy paste this whole line after changing the info with mines or do i need first to run --recover then --recover device=D etc?

Code:

--recover size=50Gio

This is the size of the D device? So in your case it was a 50gb hard drive? The size of the btc hd is 153gb so should I put --recov_size=153Gio ?

[BitMaxz]

That's the basic thing you need to open a command prompt where the python directory is installed hence it won't work.

I copy paste this whole line after changing the info with mines or do i need first to run --recover then --recover device=D etc?

No, you need to point it to drive where your wallets or private keys you want to recover.

Code:

--recover size=50Gio

This is the size of the D device? So in your case it was a 50gb hard drive? The size of the btc hd is 153gb so should I put --recov_size=153Gio ?

Yes you need to use --recov_sie=153Gio if the size of the partition is 153GB

[nc50lc]

-snip-

Thank you, python works following your steps and the pywallet.py runs too. I have last 2 questions about the script. This is what I did so far:
Is it working properly?

Yes, it's working.
The "help" result is displayed since you don't added any command-line options.

Code:

python pywallet.py --recover --recov_device=D: --recov_size=50Gio --recov_outputdir=C:\pywallet_recov_dir

I copy paste this whole line after changing the info with mines or do i need first to run --recover then --recover device=D etc?

Code:

--recover size=50Gio

This is the size of the D device? So in your case it was a 50gb hard drive? The size of the btc hd is 153gb so should I put --recov_size=153Gio ?

Those command-line options  should be supplied together or pywallet.py --recover wont proceed (it will tell you what parameter is missing).
And yes, the "recov_size" is the size that you want pywallet to check, it can be lower than the disk's size but checking the disk's full size is recommended.
For the "recov_device" letter, it should be the same as the (clone) Disk's drive letter as seen in your File Explorer or Disk Management.
"recov_outputdir" is where the recovered_wallet.dat will be saved.

After successfully entering a proper command, it will ask you to provide password for the wallet.dat that it will create where the recovered keys will be saved.
Then a bunch of possible passwords of the deleted keys or wallets (one line [password->enter] per password, leave the last one blank [just press enter] to begin the search).
note: characters wont be displayed while you're typing the passwords.

[rosnick92]

-snip-

Thank you, python works following your steps and the pywallet.py runs too. I have last 2 questions about the script. This is what I did so far:
Is it working properly?

Yes, it's working.
The "help" result is displayed since you don't added any command-line options.

Code:

python pywallet.py --recover --recov_device=D: --recov_size=50Gio --recov_outputdir=C:\pywallet_recov_dir

I copy paste this whole line after changing the info with mines or do i need first to run --recover then --recover device=D etc?

Code:

--recover size=50Gio

This is the size of the D device? So in your case it was a 50gb hard drive? The size of the btc hd is 153gb so should I put --recov_size=153Gio ?

Those command-line options  should be supplied together or pywallet.py --recover wont proceed (it will tell you what parameter is missing).
And yes, the "recov_size" is the size that you want pywallet to check, it can be lower than the disk's size but checking the disk's full size is recommended.
For the "recov_device" letter, it should be the same as the (clone) Disk's drive letter as seen in your File Explorer or Disk Management.
"recov_outputdir" is where the recovered_wallet.dat will be saved.

After successfully entering a proper command, it will ask you to provide password for the wallet.dat that it will create where the recovered keys will be saved.
Then a bunch of possible passwords of the deleted keys or wallets (one line [password->enter] per password, leave the last one blank [just press enter] to begin the search).
note: characters wont be displayed while you're typing the passwords.

Thank you for your help and in general thank you to all who tried to help me on this quest. I did the research but 0 wallets or keys were found. Unlucky.

In order to put the final nail on the coffin and let this whole reseach go, is there any way for me to see the history of installed software in windows?

I would like to have the confirmation this is the computer i remember using. Or if there's any new file that the bitcoin client creates or overwritten file. Some trace left even after the unistall of the client?

[nc50lc]

Or if there's any new file that the bitcoin client creates or overwritten file. Some trace left even after the unistall of the client?

Bitcoin Core's "data directory" wont be deleted even if the client was uninstalled, its default location is in %appdata%/bitcoin.
%appdata% in Windows is in "<Drive letter>:/Users/<Your_Username>/AppData/Roaming"
You need to enable 'hidden files' view to find the appdata folder.

Before giving-up, you might want to try the other tools.
But in my test, pywallet -recover can definitely recover keys from a deleted wallet.

[rosnick92]

Or if there's any new file that the bitcoin client creates or overwritten file. Some trace left even after the unistall of the client?

Bitcoin Core's "data directory" wont be deleted even if the client was uninstalled, its default location is in %appdata%/bitcoin.
%appdata% in Windows is in "<Drive letter>:/Users/<Your_Username>/AppData/Roaming"
You need to enable 'hidden files' view to find the appdata folder.

Before giving-up, you might want to try the other tools.
But in my test, pywallet -recover can definitely recover keys from a deleted wallet.

That hd has windows xp installed so this is the directory i checked C:\Documents and Settings\YourUserName\Application data\Bitcoin but there was no bitcoin folder.

Isn't another way to check? I read online that I could use the eventlog to check events, but it stores up to a certain numbers of entries so it might be too far back in time. But even that, how should I use the eventlog to check on an external hard drive? Any idea?

[nc50lc]

That hd has windows xp installed so this is the directory i checked C:\Documents and Settings\YourUserName\Application data\Bitcoin but there was no bitcoin folder.

Okay, but if the cloned disk is mounted to another PC, it shouldn't be in 'C' drive.
Are you still using the disk as the system drive?... because as stated, it's unsafe for the potentially recoverable keys.

[hZti]

The best way is to go to a professional data recovery company of you think there is a large enough amount of Bitcoin possibly on the drive. Maybe you can get a deal that they only get paid if the find the private key. If you use the computer and the keys were deleted there is a large risk that the computer overwrites the deleted keys with new data that you produce. Because if you deleted stuff it is simply labeled as "can be overwritten" and is not actually deleted. SO if you produce new data it will actually be lost and a professional user can remove the "can be overwritten" label.

[rosnick92]

That hd has windows xp installed so this is the directory i checked C:\Documents and Settings\YourUserName\Application data\Bitcoin but there was no bitcoin folder.

Okay, but if the cloned disk is mounted to another PC, it shouldn't be in 'C' drive.
Are you still using the disk as the system drive?... because as stated, it's unsafe for the potentially recoverable keys.

I miswrote because i copy pasted it from notes i have. The btc wallet is D which i cloned in E and E is the drive ive been using for all the searches.