Hex Editor Search for 2012-2015 Electrum Wallet

[jbrogan]

I have been on a quest for the past 2 years to find some old wallets I used back in 2012 and up.  I lost interest in the whole BTC stuff in 2015 and now realize my wallet(s) may have quite a bit of BTC sitting idle.  Problem is i've replaced hard drives over the years and have overwritten a lot of stuff, etc.   I have 26 old drives in a shoebox but there are no typical c:/User/me/AppData/Roaming/Electrum/...  type of paths which would make my life easy.

Is there a string I can look for that would tell me when I've found my electrum wallet?  I want to see if any of them are still viable/in-one-piece.  Or any string that would put me "close" to my wallet where I can sift through the data on the drive to see if I can find it?

Thanks

[BitMaxz]

Actually, that's the default path where you can find the wallet file if you can't find it there you maybe use a portable Electrum before. If yes you can only find the wallet file in the same folder where you open the Portable Electrum usually in the download folder or on this path below

Code:

C:\Users\Admin\Downloads\

Why don't you try to use explorer search and use the keyword "wallet" you can maybe find it. You can also use this tool called Everything to find the wallet.

[jackg]

How big are the drives? If they're under 1tb you could image them onto (4) bigger (eg 24tb) drives and then scan through those images a lot easier. It's might be worth considering they're lost though if you keep writing to them and haven't put them in areas they'd be protected (or backed them up).

It'd make sense to search for strings like "electrum" and "default-wallet" it'd also make sense to try to work out how electrum stores encrypted and unencrypted wallet files and find a string from those (but I'm not too sure how they're stored).

[jbrogan]

How big are the drives? If they're under 1tb you could image them onto (4) bigger (eg 24tb) drives and then scan through those images a lot easier. It's might be worth considering they're lost though if you keep writing to them and haven't put them in areas they'd be protected (or backed them up).

It'd make sense to search for strings like "electrum" and "default-wallet" it'd also make sense to try to work out how electrum stores encrypted and unencrypted wallet files and find a string from those (but I'm not too sure how they're stored).

That's exactly what I have done.  I have two 20TB external drives which I've imaged everything onto in their own image files (Disk Drill is fantastic for that).

The issue I'm running into is I see pieces and references to electrum but I'm wondering if there are any beginning-of-file bits or common hex strings that I can search for which would show me the beginning of a wallet file.

The paths are gone because I am sure when I gave up with BTC I just deleted the install.  But i know the data is still there.  The drives have been untouched for all these years.  Just sitting in a box.  I've also used unerasing tools to no avail. That's why i'm down to using the lowest level type of search - hex editor/search tools.

Thanks

[BitMaxz]

The issue I'm running into is I see pieces and references to electrum but I'm wondering if there are any beginning-of-file bits or common hex strings that I can search for which would show me the beginning of a wallet file.

I think it's a random string you can't just easily find them by searching it through hex strings there is an old discussion about this that you can find here "Hex pattern for electrum wallet".
Check the post by HCP it should explain about the wallet file with different hex strings.

The easiest one that I can suggest is to use a search tool just like what I said before if you have already done that thing then possible that you named the wallet file with a different name. 20TB is such a huge drive the software that I mentioned above I tested it for big drives to find the right file you can try the advanced search.

[flatfly]

I have been on a quest for the past 2 years to find some old wallets I used back in 2012 and up.  I lost interest in the whole BTC stuff in 2015 and now realize my wallet(s) may have quite a bit of BTC sitting idle.  Problem is i've replaced hard drives over the years and have overwritten a lot of stuff, etc.   I have 26 old drives in a shoebox but there are no typical c:/User/me/AppData/Roaming/Electrum/...  type of paths which would make my life easy.

Is there a string I can look for that would tell me when I've found my electrum wallet?  I want to see if any of them are still viable/in-one-piece.  Or any string that would put me "close" to my wallet where I can sift through the data on the drive to see if I can find it?

Thanks

There's no single answer to that, but for Electrum 1.x wallet formats (2011->2014), I would suggest searching for the following ASCII pattern:

'seed_version': 4

Hex equivalent:

27 73 65 65 64 5F 76 65 72 73 69 6F 6E 27 3A 20 34

[jbrogan]

Thank you.  THAT definitely helps.
I will search for that next.

[flatfly]

Good luck!  Persistence is key.

It was also a multi-year search to recover some of my old wallets - then I had to brute force a password I had managed to completely forget...
Wasn't easy, but thankfully it worked out fine.

[nc50lc]

Take note that the Bytes provided above only apply to slightly newer v4 seed wallets, the oldest wallets from 2012 wallets don't have those.

To look for older wallets, but only if you've set the default server, look for 'ecdsa.org':

Code:

27 65 63 64 73 61 2e 6f 72 67

Your addresses and private keys should be at the next few bytes.