I lose my wallet ! Help and Rewards

[Berkeleydb1]

I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)

There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)

I waiting for your ideas and suggestions.


I used several file recovery programs but i couldn't find the wallet.dat file. Could the name of the file have changed?

I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ??

I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ).

I used jackjack/pywallet  scanned the hard drive but found nothing. I used this code :

Code:

Code:

C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device G: --recov_size=465Gio --recov_outputdir C:\2

Gives a fault : ''pycrypto or lib ssl not found''

when it asks for possible passwords i can't type anything just enter key works
where is the problem??

old hdd : IDE
windows 8.1
python 2.7

now i am trying to convert all hex codes and try, and waiting your help.

[1715334488]

1715334488

[1715334488]

1715334488

[1715334488]

1715334488

[1715334488]

1715334488

[jackg]

I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)

Are you sure you had bitcoins back in 2012?

What format have you been able to recover files in so far? Have the recovery programmes managed to recover any files from your system (extensions might be handy here to see if any dat files have already been recovered)?

There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)

That sounds like it's been overwritten or you're not using good recovery software.

Have you searched the drive for wallet.dat if it's working properly - and just left that search running?

[takuma sato]

I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)

There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)

I waiting for your ideas and suggestions.

Look up whatever latest software forensic professionals are using. I know Recuva but that is very casual, you would need the best in the game, probably external tools and hardware. Avoid all of these dodgy "give me your HDD and we will give you back your coins".

Also are you sure you used NTFS format? try FAT32. It was still used back then. Always backup the data before doing format conversions.

[EdouardDuval]

I can help i think.Use pywallet you can find deleted private keys from storage.
I was able to find some of my private keys thanks to this software.
If you need help, don't hesitate to post and i'll explain it all here.

[NotATether]

Look up whatever latest software forensic professionals are using.

That is most likely a generic recovery program that tries to recover all files. However, OP is only interested in Berkeley DB version 4 files. So you'd need specific software that scans every single unallocated sector in the disk's filesystem (and this is significantly easier to do for Linux filesystems than Windows NTFS and FAT32, because of the openness of the filesystem source code) and scan for anything that looks like a table, ckey, mkey and such.

But if the wallet file is encrypted, I'm not sure what is to be gained from doing this - you only need the mkey, since it generates all the other private keys and morever, it is used to encrypt all those ckeys - the password is not used for that purpose.

[hZti]

So you mined bitcoin for several years without knowing what it is and in the end deleting the files  Sounds strange but looking at the value of bitcoin it could be possible that it is wort to give the drives to a professional data recovery company assuming you know all your passwords.

[NeuroticFish]

For the broken HDD I'd look for professionals. On the other on I'd look for wallet files and private keys (see pywallet app for searching).

Afaik there is also one trusted person on the forum who can do this (I guess that somebody will post his username), but you have to be very careful and cross-check the info since scammers too may come and pretend to try to help you.

[ABCbits]

I was mining bitcoin in 2012 and I had a wallet with several bitcoins. I deleted bitcoin files using CCleaner in 2015. yes I made a mistake because I didn't know what bitcoin was for. Shortly after, my computer broke down, but I have a hard drive and it was converted to RAW format. I tried everything to convert the raw hard drive to NTFS format but without success. I tried several data recovery programs but I can't find the bitcoin files. (This hard drive SATA)

I'd suggest you to bring your HDD to expert due to these reasons,
1. When you use CCleaner to delete file, it does more than marking the file as deleted. AFAIK by default it perform simple overwrite.
2. Some software to convert RAW to NTFS could cause data loss.

There is another hard drive where I mined Bitcoin in 2010 and that hard drive is working and files were not overwritten, but file recovery program cannot find bitcoin qt files. (This hard drive İDE)

Why do you think it's not overwritten when recovery program can't even find the file?

[gmaxwell]

So long as the wallet was unencrypted and the data still exists this tool will recover it https://bitcointalk.org/index.php?topic=25091.0  and can be pointed at a raw disk image.

[n0nce]

So long as the wallet was unencrypted and the data still exists this tool will recover it https://bitcointalk.org/index.php?topic=25091.0  and can be pointed at a raw disk image.

I saw that tool some time ago. But since it's created 11 years ago for 32-bit linux OS, i have doubt it will run on modern linux OS (with exception Debian for i386/x86 architecture). Do you have experience running/using it in past few years?

http://www.makomk.com/~aidan/wallet-recover-0.3-linux.tar.gz runs perfectly on latest 64-bit OpenSUSE Leap 15.4, Linux kernel 5.14.21.
The folder includes a 64-bit binary.

Code:

$ hostnamectl
[...]
      Kernel: Linux 5.14.21-150400.24.18-default
Architecture: x86-64
[...]

[ABCbits]

So long as the wallet was unencrypted and the data still exists this tool will recover it https://bitcointalk.org/index.php?topic=25091.0  and can be pointed at a raw disk image.

I saw that tool some time ago. But since it's created 11 years ago for 32-bit linux OS, i have doubt it will run on modern linux OS (with exception Debian for i386/x86 architecture). Do you have experience running/using it in past few years?

http://www.makomk.com/~aidan/wallet-recover-0.3-linux.tar.gz runs perfectly on latest 64-bit OpenSUSE Leap 15.4, Linux kernel 5.14.21.
The folder includes a 64-bit binary.

Code:

$ hostnamectl
[...]
      Kernel: Linux 5.14.21-150400.24.18-default
Architecture: x86-64
[...]

Thanks for the confirmation. I just tried it on Debian 64-bit VM and it works without any problem. On a side note, i archived it at https://web.archive.org/web/20220826092610/https://www.makomk.com/~aidan/wallet-recover-0.3-linux.tar.gz in case the website is permanently gone.

[Berkeleydb1]

I used several file recovery programs but i couldn't find the wallet.dat file. Could the name of the file have changed?

I searched '0201010420' using a hex editor but i found a lot of results (890). They all look a like starting 'D0 30' it's ending '00 00'. I don't know if there is another program that creates this order ??

I don't remember putting a password on the wallet.( if there is a password I remember my possible passwords ).

I used jackjack/pywallet  scanned the hard drive but found nothing. I used this code :

Code:
C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device C: --recov_size=465Gio --recov_outputdir C:\Users\Hoss\Desktop\found_wallet

Gives a fault : ''pycrypto or lib ssl not found''

where is the problem??

old hdd : IDE
windows 8.1
python 2.7

now i am trying to convert all hex codes and try, and waiting your help.

[nc50lc]

I used jackjack/pywallet  scanned the hard drive but found nothing. I used this code :
-snip-
Gives a fault : ''pycrypto or lib ssl not found''

where is the problem??

The complete message should be "WARNING:root:pycrypto or libssl not found, decryption may be slow".
It should still work but slower, did it end with another error?

But I see that you're recovering from C: drive which is the system drive and also set a folder in that drive as the output folder of pywallet.
That not recommended since the data that you want to recover may get overwritten by pywallet's output itself or your OS's page files, not to mention the files that you've downloaded/written to the disk.

[Berkeleydb1]

I used jackjack/pywallet  scanned the hard drive but found nothing. I used this code :
-snip-
Gives a fault : ''pycrypto or lib ssl not found''

where is the problem??

The complete message should be "WARNING:root:pycrypto or libssl not found, decryption may be slow".
It should still work but slower, did it end with another error?

But I see that you're recovering from C: drive which is the system drive and also set a folder in that drive as the output folder of pywallet.
That not recommended since the data that you want to recover may get overwritten by pywallet's output itself or your OS's page files, not to mention the files that you've downloaded/written to the disk.

I wrote this code like this :

Code:

C:\Users\Hoss\Documents\pywallet-win-files-master>pywallet.py --recover --recov_device G: --recov_size=465Gio --recov_outputdir C:\2

and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'  

I do not know what to do.

[nc50lc]

-snip-
and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'  

I do not know what to do.

I cannot find any reference on the code pointing to that specific error aside from the full message in my previous post which is benign.

Did it asked for the to-be-created "recovered-walelt.dat"?
Did it asked for possible passphrases after that?
if so, pywallet did its job and didn't found anything from the --recov_device.

For reference, it'll output something like this if it found nothing:

Code:

0.00 Go read
...
n.nn Go read

Read n Go in n minutes

Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..

Otherwise, it'll output something like this is it found possible wallets and/or keys but with '0' result:

Code:

...
Found n possible wallets
Found n possible encrypted keys
Found n possible unencrypted keys

...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key

Does it look like the former?
or the latter where it shows possible wallets/keys but output's nothing to the recovered wallet.dat?

Because for the former, it means that there's no wallet.dat found in the disk.
For the latter, it's either the passphrase is incorrect or you've provided a passphrase for unencrypted keys.

[Berkeleydb1]

-snip-
and before the scan starts ''pycrypto or lib ssl not found' I get an error. and no results are found '0'  

I do not know what to do.

I cannot find any reference on the code pointing to that specific error aside from the full message in my previous post which is benign.

Did it asked for the to-be-created "recovered-walelt.dat"?
Did it asked for possible passphrases after that?
if so, pywallet did its job and didn't found anything from the --recov_device.

For reference, it'll output something like this if it found nothing:

Code:

0.00 Go read
...
n.nn Go read

Read n Go in n minutes

Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..

Otherwise, it'll output something like this is it found possible wallets and/or keys but with '0' result:

Code:

...
Found n possible wallets
Found n possible encrypted keys
Found n possible unencrypted keys

...recovered_wallet_nnnnnnnnnn.dat contains the 0 recovered key

Does it look like the former?
or the latter where it shows possible wallets/keys but output's nothing to the recovered wallet.dat?

Because for the former, it means that there's no wallet.dat found in the disk.
For the latter, it's either the passphrase is incorrect or you've provided a passphrase for unencrypted keys.

I remember my balance in bitcoin-qt file, I even remember the day I deleted it.

When I search with hex editor, I can find the result ''0201010420'' and much more.


but in pywallet scan I find this result :

Code:

0.00 Go read
...
n.nn Go read

Read n Go in n minutes

Found 0 possible wallets
Found 0 possible encrypted keys
Found 0 possible unencrypted keys
..

Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ?
should i use a different python script ? or code?

Is there another program with ''0201010420'' hex codes?

[Bitarock]

 Hi when you find the 01010420 you count 64 characters after it and you will get your private key. I would copy it down. Then you take that and convert it to Wif number. Youll need to find a converter to get Wif format.
If it works you can send me a reward also. If you need help ask.

[Berkeleydb1]

Hi when you find the 01010420 you count 64 characters after it and you will get your private key. I would copy it down. Then you take that and convert it to Wif number. Youll need to find a converter to get Wif format.
If it works you can send me a reward also. If you need help ask.

Yes i am trying hex codes, but there are too many.

[nc50lc]

-snip-

Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ?
should i use a different python script ? or code?

Last time I tried, it can recover private keys from a deleted wallet.dat file, it can recover the keys regardless of the wallet.dat's name.
but in my recent tests (just yesterday after my previous post) it failed to do so; IDK, maybe because the wallet.dat was just saved in my test drive's cache.

Anyways, you should try another tool, specially the one suggested by others above.

[Berkeleydb1]

-snip-

Can pywallet find files with a changed name? Or maybe the wallet.dat file has been overwritten ?
should i use a different python script ? or code?

Last time I tried, it can recover private keys from a deleted wallet.dat file, it can recover the keys regardless of the wallet.dat's name.
but in my recent tests (just yesterday after my previous post) it failed to do so; IDK, maybe because the wallet.dat was just saved in my test drive's cache.

Anyways, you should try another tool, specially the one suggested by others above.

Thanks for your reply. I tried a new wallet.dat file and managed to find it but no keys were found.i am trying hex codes now.wallet.dat wasn't encrypted, that's what I remember.I will report the results.