Berkeleydb1 (OP)
Newbie
Offline
Activity: 11
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 23, 2022, 12:16:15 PM Last edit: September 16, 2022, 07:34:54 PM by Berkeleydb1 |
|
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA) There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE) I waiting for your ideas and suggestions. I used several file recovery programs but i couldn't find the wallet.dat file. Could the name of the file have changed? I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ?? I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ). I used jackjack/pywallet scanned the hard drive but found nothing. I used this code : Code: C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device G: --recov_size=465Gio --recov_outputdir C:\2 Gives a fault : ''pycrypto or lib ssl not found'' when it asks for possible passwords i can't type anything just enter key works where is the problem?? old hdd : IDE windows 8.1 python 2.7 now i am trying to convert all hex codes and try, and waiting your help.
|
|
|
|
jackg
Copper Member
Legendary
Offline
Activity: 2856
Merit: 3071
https://bit.ly/387FXHi lightning theory
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 23, 2022, 12:44:22 PM |
|
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)
Are you sure you had bitcoins back in 2012? What format have you been able to recover files in so far? Have the recovery programmes managed to recover any files from your system (extensions might be handy here to see if any dat files have already been recovered)? There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
That sounds like it's been overwritten or you're not using good recovery software. Have you searched the drive for wallet.dat if it's working properly - and just left that search running?
|
|
|
|
takuma sato
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 23, 2022, 03:16:51 PM |
|
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)
There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
I waiting for your ideas and suggestions.
Look up whatever latest software forensic professionals are using. I know Recuva but that is very casual, you would need the best in the game, probably external tools and hardware. Avoid all of these dodgy "give me your HDD and we will give you back your coins". Also are you sure you used NTFS format? try FAT32. It was still used back then. Always backup the data before doing format conversions.
|
|
|
|
EdouardDuval
Newbie
Offline
Activity: 22
Merit: 6
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 23, 2022, 05:59:46 PM |
|
I can help i think.Use pywallet you can find deleted private keys from storage. I was able to find some of my private keys thanks to this software. If you need help, don't hesitate to post and i'll explain it all here.
|
|
|
|
NotATether
Legendary
Offline
Activity: 1694
Merit: 7150
In memory of o_e_l_e_o
|
Look up whatever latest software forensic professionals are using.
That is most likely a generic recovery program that tries to recover all files. However, OP is only interested in Berkeley DB version 4 files. So you'd need specific software that scans every single unallocated sector in the disk's filesystem (and this is significantly easier to do for Linux filesystems than Windows NTFS and FAT32, because of the openness of the filesystem source code) and scan for anything that looks like a table, ckey, mkey and such. But if the wallet file is encrypted, I'm not sure what is to be gained from doing this - you only need the mkey, since it generates all the other private keys and morever, it is used to encrypt all those ckeys - the password is not used for that purpose.
|
|
|
|
hZti
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 23, 2022, 09:45:12 PM |
|
So you mined bitcoin for several years without knowing what it is and in the end deleting the files ![Huh](https://bitcointalk.org/Smileys/default/huh.gif) Sounds strange but looking at the value of bitcoin it could be possible that it is wort to give the drives to a professional data recovery company assuming you know all your passwords.
|
|
|
|
NeuroticFish
Legendary
Offline
Activity: 3766
Merit: 6477
Looking for campaign manager? Contact icopress!
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 24, 2022, 05:41:42 AM |
|
For the broken HDD I'd look for professionals. On the other on I'd look for wallet files and private keys (see pywallet app for searching). Afaik there is also one trusted person on the forum who can do this (I guess that somebody will post his username), but you have to be very careful and cross-check the info since scammers too may come and pretend to try to help you.
|
|
|
|
ABCbits
Legendary
Offline
Activity: 2968
Merit: 7780
Crypto Swap Exchange
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 24, 2022, 01:00:01 PM |
|
I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)
I'd suggest you to bring your HDD to expert due to these reasons, 1. When you use CCleaner to delete file, it does more than marking the file as deleted. AFAIK by default it perform simple overwrite. 2. Some software to convert RAW to NTFS could cause data loss. There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)
Why do you think it's not overwritten when recovery program can't even find the file?
|
|
|
|
|
n0nce
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 25, 2022, 03:13:03 PM |
|
I saw that tool some time ago. But since it's created 11 years ago for 32-bit linux OS, i have doubt it will run on modern linux OS (with exception Debian for i386/x86 architecture). Do you have experience running/using it in past few years? http://www.makomk.com/~aidan/wallet-recover-0.3-linux.tar.gz runs perfectly on latest 64-bit OpenSUSE Leap 15.4, Linux kernel 5.14.21. The folder includes a 64-bit binary. $ hostnamectl [...] Kernel: Linux 5.14.21-150400.24.18-default Architecture: x86-64 [...]
|
|
|
|
ABCbits
Legendary
Offline
Activity: 2968
Merit: 7780
Crypto Swap Exchange
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
August 26, 2022, 09:30:23 AM |
|
I saw that tool some time ago. But since it's created 11 years ago for 32-bit linux OS, i have doubt it will run on modern linux OS (with exception Debian for i386/x86 architecture). Do you have experience running/using it in past few years? http://www.makomk.com/~aidan/wallet-recover-0.3-linux.tar.gz runs perfectly on latest 64-bit OpenSUSE Leap 15.4, Linux kernel 5.14.21. The folder includes a 64-bit binary. $ hostnamectl [...] Kernel: Linux 5.14.21-150400.24.18-default Architecture: x86-64 [...]
Thanks for the confirmation. I just tried it on Debian 64-bit VM and it works without any problem. On a side note, i archived it at https://web.archive.org/web/20220826092610/https://www.makomk.com/~aidan/wallet-recover-0.3-linux.tar.gz in case the website is permanently gone.
|
|
|
|
Berkeleydb1 (OP)
Newbie
Offline
Activity: 11
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 04, 2022, 12:23:13 PM |
|
I used several file recovery programs but i couldn't find the wallet.dat file. Could the name of the file have changed?
I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ??
I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ).
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code :
Code: C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device C: --recov_size=465Gio --recov_outputdir C:\Users\Hoss\Desktop\found_wallet
Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
old hdd : IDE windows 8.1 python 2.7
now i am trying to convert all hex codes and try, and waiting your help.
|
|
|
|
nc50lc
Legendary
Offline
Activity: 2506
Merit: 5924
Self-proclaimed Genius
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 04, 2022, 12:30:27 PM |
|
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code : -snip- Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
The complete message should be " WARNING:root:pycrypto or libssl not found, decryption may be slow". It should still work but slower, did it end with another error? But I see that you're recovering from C: drive which is the system drive and also set a folder in that drive as the output folder of pywallet. That not recommended since the data that you want to recover may get overwritten by pywallet's output itself or your OS's page files, not to mention the files that you've downloaded/written to the disk.
|
|
|
|
Berkeleydb1 (OP)
Newbie
Offline
Activity: 11
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 04, 2022, 12:40:23 PM |
|
I used jackjack/pywallet scanned the hard drive but found nothing. I used this code : -snip- Gives a fault : ''pycrypto or lib ssl not found''
where is the problem??
The complete message should be " WARNING:root:pycrypto or libssl not found, decryption may be slow". It should still work but slower, did it end with another error? But I see that you're recovering from C: drive which is the system drive and also set a folder in that drive as the output folder of pywallet. That not recommended since the data that you want to recover may get overwritten by pywallet's output itself or your OS's page files, not to mention the files that you've downloaded/written to the disk. I wrote this code like this : C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device G: --recov_size=465Gio --recov_outputdir C:\2 and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0' I do not know what to do.
|
|
|
|
nc50lc
Legendary
Offline
Activity: 2506
Merit: 5924
Self-proclaimed Genius
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 04, 2022, 01:13:54 PM |
|
-snip- and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'
I do not know what to do.
I cannot find any reference on the code pointing to that specific error aside from the full message in my previous post which is benign. Did it asked for the to-be-created " recovered-walelt.dat"? Did it asked for possible passphrases after that? if so, pywallet did its job and didn't found anything from the --recov_device. For reference, it'll output something like this if it found nothing: 0.00 Go read ... n.nn Go read
Read n Go in n minutes
Found 0 possible wallets Found 0 possible encrypted keys Found 0 possible unencrypted keys .. Otherwise, it'll output something like this is it found possible wallets and/or keys but with '0' result: ... Found n possible wallets Found n possible encrypted keys Found n possible unencrypted keys
...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key
Does it look like the former? or the latter where it shows possible wallets/keys but output's nothing to the recovered wallet.dat? Because for the former, it means that there's no wallet.dat found in the disk. For the latter, it's either the passphrase is incorrect or you've provided a passphrase for unencrypted keys.
|
|
|
|
Berkeleydb1 (OP)
Newbie
Offline
Activity: 11
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 04, 2022, 01:37:53 PM |
|
-snip- and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'
I do not know what to do.
I cannot find any reference on the code pointing to that specific error aside from the full message in my previous post which is benign. Did it asked for the to-be-created " recovered-walelt.dat"? Did it asked for possible passphrases after that? if so, pywallet did its job and didn't found anything from the --recov_device. For reference, it'll output something like this if it found nothing: 0.00 Go read ... n.nn Go read
Read n Go in n minutes
Found 0 possible wallets Found 0 possible encrypted keys Found 0 possible unencrypted keys .. Otherwise, it'll output something like this is it found possible wallets and/or keys but with '0' result: ... Found n possible wallets Found n possible encrypted keys Found n possible unencrypted keys
...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key
Does it look like the former? or the latter where it shows possible wallets/keys but output's nothing to the recovered wallet.dat? Because for the former, it means that there's no wallet.dat found in the disk. For the latter, it's either the passphrase is incorrect or you've provided a passphrase for unencrypted keys. I remember my balance in bitcoin-qt file, I even remember the day I deleted it. When I search with hex editor, I can find the result ''0201010420'' and much more. but in pywallet scan I find this result : 0.00 Go read ... n.nn Go read
Read n Go in n minutes
Found 0 possible wallets Found 0 possible encrypted keys Found 0 possible unencrypted keys .. Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ? should i use a different python script ? or code? Is there another program with ''0201010420'' hex codes?
|
|
|
|
Bitarock
Newbie
Offline
Activity: 28
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 04, 2022, 08:50:25 PM |
|
Hi when you find the 01010420 you count 64 characters after it and you will get your private key. I would copy it down. Then you take that and convert it to Wif number. Youll need to find a converter to get Wif format. If it works you can send me a reward also. If you need help ask.
|
|
|
|
Berkeleydb1 (OP)
Newbie
Offline
Activity: 11
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 04, 2022, 09:29:40 PM |
|
Hi when you find the 01010420 you count 64 characters after it and you will get your private key. I would copy it down. Then you take that and convert it to Wif number. Youll need to find a converter to get Wif format. If it works you can send me a reward also. If you need help ask.
Yes i am trying hex codes, but there are too many.
|
|
|
|
nc50lc
Legendary
Offline
Activity: 2506
Merit: 5924
Self-proclaimed Genius
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 05, 2022, 04:16:12 AM |
|
-snip-
Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ? should i use a different python script ? or code? Last time I tried, it can recover private keys from a deleted wallet.dat file, it can recover the keys regardless of the wallet.dat's name. but in my recent tests ( just yesterday after my previous post) it failed to do so; IDK, maybe because the wallet.dat was just saved in my test drive's cache. Anyways, you should try another tool, specially the one suggested by others above.
|
|
|
|
Berkeleydb1 (OP)
Newbie
Offline
Activity: 11
Merit: 0
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
September 05, 2022, 07:05:32 AM |
|
-snip-
Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ? should i use a different python script ? or code? Last time I tried, it can recover private keys from a deleted wallet.dat file, it can recover the keys regardless of the wallet.dat's name. but in my recent tests ( just yesterday after my previous post) it failed to do so; IDK, maybe because the wallet.dat was just saved in my test drive's cache. Anyways, you should try another tool, specially the one suggested by others above. Thanks for your reply. I tried a new wallet.dat file and managed to find it but no keys were found.i am trying hex codes now.wallet.dat wasn't encrypted, that's what I remember.I will report the results.
|
|
|
|
|