Question about recovering BTC from 2010/2011

[FinanceOlive]

Hello! I'm fairly new to this whole cryptocurrency thing, and the reason I find myself posting here is that I have a friend who confided in me recently that a long time ago, in 2010, he believes to have purchased Bitcoin that he stored away and forgot about. Now, obviously, charting the market value of Bitcoin, I've determined that even if he purchased a small amount, it would be worth substantially more today.

The reason he never investigated it until now is because up until about 2014 or so he forgot about his minor investment, because at the time it didn't seem like anything important, and then he had a serious accident that left him hospital bound and in rehab for a long time. He hasn't told anyone else about this potential holding that he has, and as a close friend he's confided in me recently that he wonders what happened to it, and if it's still accessible to him.

Here's the problem: he doesn't remember much about it, as it was so long ago, but he's fairly certain it was Bitcoin, and that he paid for it on some website. And it was in 2010 or early 2011, and definitely not later.

He told me he doesn't remember downloading software for it, but he definitely remembers paying, for something that was called "Bitcoin".

So recently we examined some old computer drives he had, and we found two things:

- A text file on a memory stick dating back to early 2011 (filestamp) that contains a single 16-character text string with letters and numbers, beginning with a "1" and ending with an "l". He is fairly sure that this is somehow related to the Bitcoin that he purchased but he can't remember how. I tried looking this up as a public or private key but to no avail - it's not long enough or in the right format. I tried looking this up as an encrypted "brain wallet" to generate the Public / Private Keys, but the keys it generated do not reveal any Public Keys that contain funds or transactions.

- An old, corrupted hard drive that I scanned for evidence of "bitcoi*" and "walle*". It let me read maybe 1/5 of the drive before there was a hardware failure. I dumped the contents of that 1/5 onto my computer, and scanned the image for those words, and no hits on "walle*" but there is evidence of "Bitcoin Project" on the drive. He says the drive hasn't been touched since ~2012 or thereabouts, when it was damaged.

My questions to you guys:

- How available was Bitcoin to purchase in 2010/2011? It seems as if very few people actually exchanged Bitcoin for money back then, so if his story is correct, it must have been a pretty rare website or one of only a few. What is the most likely scenario if he did actually buy Bitcoin - what website would it have been, and how likely was this?

- What could the 16-character "key" possibly be? Like I said, I tried looking it up as a Public Key, Private Key, and a SHA256 "brain wallet" and nothing.

- What should I be looking for on the hard drive dump I have on that old drive if I want to recover anything related to Bitcoin? Were there specific text strings or byte markers I can look for in the data files stored by Bitcoin at the time? What is the significance of finding the string "Bitcoin Project" on portions of that drive?

- How should I proceed if I want to help my friend (and myself) retrieve whatever he may have purchased, if it's anything at all? And how possible is it for us to retrieve anything if there was anything in the first place? There's not much to work with other than his insistence that he bought some Bitcoin back then, the text string on the hard drive, and the mysterious "key.txt" string.

Thanks.

[LoyceV]

In short:
Just 16 characters is far too short to mean anything. It can't even be an address, and for sure won't be a private key. It could be a brain wallet. I doubt that's very likely, but it doesn't hurt to check (on an offline system).
Disk recovery is a specialized (and expensive) job. If you think it's worth it, send the disk to a specialist.
Use Pywallet to search the entire partition for private keys.

This is the tech board. Try to keep the personal stories out, that makes it easier to get to the point.

[BitMaxz]

If it is just 16 characters it's not a public key for Bitcoin because the BTC address characters are around 26-62 long or even if it has some missing characters it's just a public key and you can't use it to recover your wallet.

Since you still possess of the old hard drive you can try looking for private keys for reference use this "List of address prefixes" so that you know what private key looks like because that is the key that you need to recover your old wallet or find the wallet data that contains your old wallet.

[Mushai]

My questions to you guys:

- How available was Bitcoin to purchase in 2010/2011? It seems as if very few people actually exchanged Bitcoin for money back then, so if his story is correct, it must have been a pretty rare website or one of only a few. What is the most likely scenario if he did actually buy Bitcoin - what website would it have been, and how likely was this?

- What could the 16-character "key" possibly be? Like I said, I tried looking it up as a Public Key, Private Key, and a SHA256 "brain wallet" and nothing.

- What should I be looking for on the hard drive dump I have on that old drive if I want to recover anything related to Bitcoin? Were there specific text strings or byte markers I can look for in the data files stored by Bitcoin at the time? What is the significance of finding the string "Bitcoin Project" on portions of that drive?

- How should I proceed if I want to help my friend (and myself) retrieve whatever he may have purchased, if it's anything at all? And how possible is it for us to retrieve anything if there was anything in the first place? There's not much to work with other than his insistence that he bought some Bitcoin back then, the text string on the hard drive, and the mysterious "key.txt" string.

Thanks.

Mt Gox account confirmation codes were 16 characters long, and they were operating since 2010.

If they were using a public email system like hotmail, and you still have access try searching the email for the 16 character string.

If you can find the account creation confirmation, it will have their user ID in the link. With the user ID you can look up the balance in the Mt Gox data leak files. Alternatively Mt Gox would have sent trade alerts to the email address

Unfortunately of it was a Mt Gox account, you have missed all the creditor repayment deadlines, and your bitcoin is lost, unless it was withdrawn to a bitcoin wallet.  In which case they would have send an email saying so.

[nc50lc]

He told me he doesn't remember downloading software for it, but he definitely remembers paying, for something that was called "Bitcoin".

In that case, instead of prioritizing file recovery, look for physical backups like private key(s) written on paper first.
And since it's that date, it should be any format of a private key but not any form of HD wallet backup like seed phrase or master private keys.

Also, his "key.txt" file doesn't look anything like a WIF/Mini private key, it even got an invalid base58 character "l" with it.
Since you already tried it as a Brainwallet passpharse, you've already confirmed that it isn't a mini private key.

Perhaps, it's some key string that can get to his account to an old Exchange or web wallet, both don't require him to install any software.

[ABCbits]

Here's the problem: he doesn't remember much about it, as it was so long ago, but he's fairly certain it was Bitcoin, and that he paid for it on some website. And it was in 2010 or early 2011, and definitely not later.

- How available was Bitcoin to purchase in 2010/2011? It seems as if very few people actually exchanged Bitcoin for money back then, so if his story is correct, it must have been a pretty rare website or one of only a few. What is the most likely scenario if he did actually buy Bitcoin - what website would it have been, and how likely was this?

AFAIK all exchange which exist since 2010 or early 2011 no longer exists. But if you count middle or late 2011, ask him whether 2 exchange called "Kraken" and "Bitstamp" remind him of anything.

- What could the 16-character "key" possibly be? Like I said, I tried looking it up as a Public Key, Private Key, and a SHA256 "brain wallet" and nothing.

Bitcoin private key is 256-bit of data. With common format (binary, hex, base58 or base64), it's impossible to fit 256-bit of data into 16 characters. Even mini private keys have either 22 or 30 characters.

[FinanceOlive]

Two further questions:

- If he made a web wallet or bought from an exchange back then, which were operational in that time frame (late 2010-mid 2011)? So I could look them up and see if any of his emails still work on these sites, or that key works.

- We're looking for more old hard drives he might have. If I scan the disk images, what text or characters can I scan for that would give me an indication that a wallet or keys are on any of these drives? Somebody on here said look for "name" as it is a field in the wallet.dat, but that is too common a word and shows up alot in a typical Windows installation. I only have a newer wallet.dat created by newer Bitcoin Core for comparison and the "name" field usually looks like this: name*bc1...  In 2010/2011, what would it have looked like?

[shield132]

- An old, corrupted hard drive that I scanned for evidence of "bitcoi*" and "walle*". It let me read maybe 1/5 of the drive before there was a hardware failure. I dumped the contents of that 1/5 onto my computer, and scanned the image for those words, and no hits on "walle*" but there is evidence of "Bitcoin Project" on the drive. He says the drive hasn't been touched since ~2012 or thereabouts, when it was damaged.

In such cases, you should seek out help from a professional data recovery company and don't try manually because as you said, then hardware failure occurred. Btw I think that Mushai is right, your friend would purchase Bitcoin from Mt Gox exchange. I think he wouldn't have set up Bitcoin Core wallet because it's a little complicated and he would have remembered that.

Two further questions:

- If he made a web wallet or bought from an exchange back then, which were operational in that time frame (late 2010-mid 2011)? So I could look them up and see if any of his emails still work on these sites, or that key works.

- We're looking for more old hard drives he might have. If I scan the disk images, what text or characters can I scan for that would give me an indication that a wallet or keys are on any of these drives? Somebody on here said look for "name" as it is a field in the wallet.dat, but that is too common a word and shows up alot in a typical Windows installation. I only have a newer wallet.dat created by newer Bitcoin Core for comparison and the "name" field usually looks like this: name*bc1...  In 2010/2011, what would it have looked like?

What do you mean in web wallet? Wallet like blockchain.info? It was created in 2011 as a blockchain explorer and wallet was created in 2012. If I recall correctly, there wasn't similar Bitcoin wallet before.
If you mean wallet generator websites in web wallet, then it's possible that he used one but I think recovery will be impossible and also these types of websites were actually scammers.