Found my old wallet.dat which seems to be corrupted. Please Help.

[givemebackmybtc]

I've been scouring through my old hard drives to find an old wallet containing some BTC I purchased many years ago, 8-10 years ago approximately. Most were formatted and some were damaged.

After 2 months and searching through 7 old drives, I finally managed to recover what looks like a wallet.dat file using the method outlined in this old thread below. I would have done this years ago if I knew deleted data is possible to recover. But I am not very technical.

https://bitcointalk.org/index.php?topic=25091.0

Note, I tried several different ways to search for the wallet, and that is the only method that managed to recover something.

Here are the challenges I am facing and need your help to understand if recovery will be possible.

1- This particular hard drive unfortunately was formatted at some point. I have no idea what else it might have gone through, but the recovery tool posted by @makomk managed to recover 1 key, and it generated a .dat file with it.
2- Loading the wallet.dat into Bitcoin Core gives me a corrupt wallet error. Using the -salvagewallet command in bitcoin-wallet.exe did not work.
3- The wallet size is concerning, it is only 16KB. The -salvagewallet tool doubled the file's size for some reason. And after some googleing, I found that wallets are typically 100KB and up.
4- Opening the recovered wallet with a Hex editor I can find some clues that this is possibly the wallet I am looking for. I found sequence 0201010420, but its followed by zeros. Also found the sequence 03 6b 65 79 41 and KeyA, which is also followed by zeros. According to this detailed French guide https://www.radjaidjah.org/index.php?post/2014/09/07/Sauver-ses-bitcoins-de-la-corruption these are relevant to a BTC wallet. I'm not technical or knowledgeable enough to know whether these sequences are related to something else or not, and this could be something other than my lost wallet.
 
With all the above in mind, a few questions come to mind.

1- Could this be a partially recovered wallet since the sequences mentioned above are all followed by zeros, file size is too small, and the hex file is generally empty?
2- The wallet is possibly encrypted and hex editor will not reveal any keys?
3- Has the wallet file been partially overwritten?
4- Are there any other methods I can use to rescan and extract the wallet file?

 Any help would be greatly appreciated.

[jackg]

1. Are you working on the disk or have you made an image of the drive to search through?

2. There's a chance the file you've recovered isn't the only copy of your wallet, there's a chance it is (especially if it's the only wallet.dat file you could possibly recover) but there's a chance the file was moved after being created (by the operating system) so there might be another copy on the drive.

3. If it can't be salvaged by bitcoin core, have you tried other wallet recovery software like pywallet (available from github). There's probably a few different types of software you can run it though faster than searching for identifiers/separators.

[nc50lc]

3- The wallet size is concerning, it is only 16KB. The -salvagewallet tool doubled the file's size for some reason. And after some googleing, I found that wallets are typically 100KB and up.

Size is fitting for new wallet.dat files which contains descriptors.
It can go as low as 12kB if unused and a few more kilobytes after deriving more addresses or after receiving transactions.

Did bitcoin-wallet salvage command returned with an error?
Also, -salvagewallet was a Bitcoin Core command line option, are you using an old version?

[givemebackmybtc]

1. Are you working on the disk or have you made an image of the drive to search through?

2. There's a chance the file you've recovered isn't the only copy of your wallet, there's a chance it is (especially if it's the only wallet.dat file you could possibly recover) but there's a chance the file was moved after being created (by the operating system) so there might be another copy on the drive.

3. If it can't be salvaged by bitcoin core, have you tried other wallet recovery software like pywallet (available from github). There's probably a few different types of software you can run it though faster than searching for identifiers/separators.

Hi, thanks for the response.

1- I have created a sector to sector clone of the hard drive using an app called HDDRawcopy and I am working the recovery on the cloned drive.

2- The tool I outlined above was the only one that managed to find something. I used Recuva and Rstudio so far, and several other recovery software that managed to recover no files at all.

3- I ran the pywallet script but it does not generate any new wallet files, nor does it give any errors in the CMD prompt.

I will attempt another scan with Rstudio using a custom extension XML I found online that targets specifically BTC wallets. I am also considering running the search and recovery option in Pywallet. Besides this, I am stuck for now and do not know if I can find someone trustworthy enough to work on the recovery.

If there is anything you recommend I do please let me know.

[givemebackmybtc]

1. Are you working on the disk or have you made an image of the drive to search through?

2. There's a chance the file you've recovered isn't the only copy of your wallet, there's a chance it is (especially if it's the only wallet.dat file you could possibly recover) but there's a chance the file was moved after being created (by the operating system) so there might be another copy on the drive.

3. If it can't be salvaged by bitcoin core, have you tried other wallet recovery software like pywallet (available from github). There's probably a few different types of software you can run it though faster than searching for identifiers/separators.

Hi, thanks for the response.

1- I have created a sector to sector clone of the hard drive using an app called HDDRawcopy and I am working the recovery on the cloned drive.

2- The tool I outlined above was the only one that managed to find something. I used Recuva and Rstudio so far, and several other recovery software that managed to recover no files at all.

3- I ran the pywallet script but it does not generate any new wallet files, nor does it give any errors in the CMD prompt.

I will attempt another scan with Rstudio using a custom extension XML I found online that targets specifically BTC wallets. I am also considering running the search and recovery option in Pywallet. Besides this, I am stuck for now and do not know if I can find someone trustworthy enough to work on the recovery.

If there is anything you recommend I do please let me know.

I used the bitcoin-wallet command:

bitcoin-wallet -wallet=mywallet salvage

No errors, but still corrupted.

[nc50lc]

I used the bitcoin-wallet command:

bitcoin-wallet -wallet=mywallet salvage

No errors, but still corrupted.

No errors, hmm, so it proceeded.
It should have created a wallet backup named after your wallet.dat file with a ".bak" extension inside the same directory as the wallet file. (can you confirm that?)
If it did and the salvaged wallet is still corrupted, then salvage can't do anything in this case.

BTW, the original wallet.dat is that ".bak" file.

[givemebackmybtc]

I used the bitcoin-wallet command:

bitcoin-wallet -wallet=mywallet salvage

No errors, but still corrupted.

No errors, hmm, so it proceeded.
It should have created a wallet backup named after your wallet.dat file with a ".bak" extension inside the same directory as the wallet file. (can you confirm that?)
If it did and the salvaged wallet is still corrupted, then salvage can't do anything in this case.

BTW, the original wallet.dat is that ".bak" file.

Yes, that is exactly what happens. The salvaged wallet file doubles in size for some reason, and when loaded thru the core it says its corrupted.

[BitMaxz]

Yes, that is exactly what happens. The salvaged wallet file doubles in size for some reason, and when loaded thru the core it says its corrupted.

Do you still have the original drive? Do you mind creating a new clone drive again and repeat the procedure to recover the wallet.dat file? This time make sure to use other software to recover them and other tools to create a new clone copy of your disks like Acronis, ghost, or Clonezilla.

I suggest burn a Hiren's BootCD or BartPE. It has  many tools to use to clone and recover deleted files.

[nc50lc]

I've been scouring through my old hard drives to find an old wallet containing some BTC I purchased many years ago, 8-10 years ago approximately. -snip-

Was your wallet encrypted with a password?
Because if it was, the tool that you've used cannot properly recover from an encrypted wallet, even on its last update, version 0.3.
It's noted on top of the thread.

With all the above in mind, a few questions come to mind.

1- Could this be a partially recovered wallet since the sequences mentioned above are all followed by zeros, file size is too small, and the hex file is generally empty?
2- The wallet is possibly encrypted and hex editor will not reveal any keys?
3- Has the wallet file been partially overwritten?
4- Are there any other methods I can use to rescan and extract the wallet file?

Since that tool doesn't support encrypted wallets, the recovered wallet may not contain any keys.

Since salvage didn't work,
You can try pywallet's recov tool which supports encrypted wallets, here's an example command and link to the tool: /index.php?topic=5408068.msg60653031#msg60653031
It requires old python2.x to work. (check the repository for the requirements & dependencies)

[givemebackmybtc]

I've been scouring through my old hard drives to find an old wallet containing some BTC I purchased many years ago, 8-10 years ago approximately. -snip-

Was your wallet encrypted with a password?
Because if it was, the tool that you've used cannot properly recover from an encrypted wallet, even on its last update, version 0.3.
It's noted on top of the thread.

With all the above in mind, a few questions come to mind.

1- Could this be a partially recovered wallet since the sequences mentioned above are all followed by zeros, file size is too small, and the hex file is generally empty?
2- The wallet is possibly encrypted and hex editor will not reveal any keys?
3- Has the wallet file been partially overwritten?
4- Are there any other methods I can use to rescan and extract the wallet file?

Since that tool doesn't support encrypted wallets, the recovered wallet may not contain any keys.

Since salvage didn't work,
You can try pywallet's recov tool which supports encrypted wallets, here's an example command and link to the tool: /index.php?topic=5408068.msg60653031#msg60653031
It requires old python2.x to work. (check the repository for the requirements & dependencies)

EDIT: OK I figured it out. Had the html of the github downloaded instead of the actual script. Now the search is running. I'll report back if it finds anything.

Many thanks!

I do not remember if it was encrypted. If it was I have some password combos in mind that I can try once I find the wallet.

I have Python2.7 installed and I tired to run the pywallet recover command but I keep getting this error:

Code:

C:\Python27>python pywallet.py --recover --recov_device=D: --recov_size=2000Gio --recov_outputdir=C:\pywallet_recov_dir
  File "pywallet.py", line 8
    <!DOCTYPE html>
    ^
SyntaxError: invalid syntax

[nc50lc]

You might have downloaded the wrong pywallet since it has an HTML file declaration in line 8: "<!DOCTYPE html>".
I think it's an HTML file which is for websites, not a python program.

Get it from this GitHub repository: https://github.com/jackjack-jj/pywallet

[givemebackmybtc]

Yes, now its running fine.

It asked for a passphrase and I inserted several that could be, will it still recover the files if the passphrase was incorrect?

[nc50lc]

It asked for a passphrase and I inserted several that could be, will it still recover the files if the passphrase was incorrect?

No, it will create a "recovered-wallet.dat" but it wont contain any keys.
But it will detect that there are possible encrypted keys that weren't decrypted if your passphrase is incorrect.

For the passphrase, the first query will be the recovered wallet's passphrase.
The possible passphrase(es) of the to-be-recovered wallet will be asked after that.

[givemebackmybtc]

It asked for a passphrase and I inserted several that could be, will it still recover the files if the passphrase was incorrect?

No, it will create a "recovered-wallet.dat" but it wont contain any keys.
But it will detect that there are possible encrypted keys that weren't decrypted if your passphrase is incorrect.

For the passphrase, the first query will be the recovered wallet's passphrase.
The possible passphrase(es) of the to-be-recovered wallet will be asked after that.

Good news and bad news.

Bad news, pywallet didn't manage to print anything after nearly a whole day search.

Good news, I ran the corrupt wallet command using pywallet on the file I initially found using the other tool, and it managed to pull a public address and what looks like a private key.

Now this isn't the wallet I am looking for as it only has .03 btc, the one I'm looking for has more (glad I at least found something after all, its worth $300-400 so worth getting recovered), but when I input the key in Bitcoin Core, I get "Invalid private key encoding (code -5)".

The private key I have starts with a 5 and is 51 characters.

Did some googling but none of the solutions I found worked.

Do I need to download an old Bitcoin Core client for it to import properly? 

[BlackHatCoiner]

Do I need to download an old Bitcoin Core client for it to import properly?

No. Bitcoin Core v23.0 does support import of uncompressed private keys. To do this (on QT), you need to create a new wallet with "Descriptor Wallet" unchecked, and on the console enter the following:

Code:

importprivkey YOUR_PRIVATE_KEY_THAT_STARTS_WITH_5

If QT is not available, run the following in CLI:

Code:

bitcoin-cli -named createwallet wallet_name=some_wallet_name descriptors=false
bitcoin-cli importprivkey YOUR_PRIVATE_KEY_THAT_STARTS_WITH_5

[givemebackmybtc]

Do I need to download an old Bitcoin Core client for it to import properly?

No. Bitcoin Core v23.0 does support import of uncompressed private keys. To do this (on QT), you need to create a new wallet with "Descriptor Wallet" unchecked, and on the console enter the following:

Code:

importprivkey YOUR_PRIVATE_KEY_THAT_STARTS_WITH_5

If QT is not available, run the following in CLI:

Code:

bitcoin-cli -named createwallet wallet_name=some_wallet_name descriptors=false
bitcoin-cli importprivkey YOUR_PRIVATE_KEY_THAT_STARTS_WITH_5

Unfortunately I tired both methods previously and still got the same error.

[nc50lc]

-snip-

Now this isn't the wallet I am looking for as it only has .03 btc, the one I'm looking for has more (glad I at least found something after all, its worth $300-400 so worth getting recovered), but when I input the key in Bitcoin Core, I get "Invalid private key encoding (code -5)".

The private key I have starts with a 5 and is 51 characters.

The number of characters seems right for an uncompressed WIF prvKey
But the error suggests that some of the characters aren't base58, it has invalid checksum or there's at least one wrong character;
is there any I, l (lower-case L), O (upper-case o), 0 (zero) in your prvKey? If so, it may not be a WIF prvKey.

BTW, it's case-sensitive in case it's manually typed.

[givemebackmybtc]

-snip-

Now this isn't the wallet I am looking for as it only has .03 btc, the one I'm looking for has more (glad I at least found something after all, its worth $300-400 so worth getting recovered), but when I input the key in Bitcoin Core, I get "Invalid private key encoding (code -5)".

The private key I have starts with a 5 and is 51 characters.

The number of characters seems right for an uncompressed WIF prvKey
But the error suggests that some of the characters aren't base58, it has invalid checksum or there's at least one wrong character;
is there any I, l (lower-case L), O (upper-case o), 0 (zero) in your prvKey? If so, it may not be a WIF prvKey.

BTW, it's case-sensitive in case it's manually typed.

There are no I, l, O, or 0 in the private key  

I'm just copy pasting from the wallet.text that pywallet generated

[BlackHatCoiner]

Unfortunately I tired both methods previously and still got the same error.

As nc50lc has pointed out, if after import of the private key to Bitcoin Core you get an encoding error, it means that the WIF (Wallet Import Format) is invalid.

There are no I, l, O, or 0 in the private key

I'd bet that you've misread a character, or written a character wrongly. If it's a 51-character long private key, that starts with 5, and has no I, l, 0, and O, then there has to be something wrong with you, or with the software that generated it back then.

Please confirm it for me: do you feel 100% confident that you can't have possibly made a mistake during writing, and it's crystal clear what the characters are?

[givemebackmybtc]

Unfortunately I tired both methods previously and still got the same error.

As nc50lc has pointed out, if after import of the private key to Bitcoin Core you get an encoding error, it means that the WIF (Wallet Import Format) is invalid.

There are no I, l, O, or 0 in the private key

I'd bet that you've misread a character, or written a character wrongly. If it's a 51-character long private key, that starts with 5, and has no I, l, 0, and O, then there has to be something wrong with you, or with the software that generated it back then.

Please confirm it for me: do you feel 100% confident that you can't have possibly made a mistake during writing, and it's crystal clear what the characters are?

So what happened is I used the old 'Bitcoin Wallet Recovery' tool I linked in my OP to search for this wallet on an old formatted drive. It managed to find one wallet, but it was corrupted.

Then I used pywallet to dump the keys from the corrupted wallet.dat file that was found. In the wallet.text file that pywallet generated, I found this 51 character key, along with an address. The address is valid and had one transaction as per blockchain explorer all the way back from 2011. Its a miniscule amount, though worth recovering as I am taking this as a learning experience incase I find the real missing wallet.

So not sure where things have gone wrong in the process, potentially the wallet.dat is incomplete or partially overwritten and pywallet generates an incorrect key because of this. For all I know the address could be incorrectly generated as well. But what are the odds of generating a random public address that has some balance  . I have no records of this address but it suits the timeline for the wallet I was originally looking for but not the amount.