Recovering private keys from a wallet.dat file

[nc50lc]

-snip- and it came out with ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
I didn't have anything to do with bitcoin open. Does this mean I have to do the other method as it is corrupted.

That error shows if pywallet can't lock of the wallet.dat usually if it's being used by Bitcoin Core or another client/program.
But yes, that also appears when pointed to a corrupted wallet file, case-to-case basis.

For the other method (--recover), your options are:

• Use an existing partition (drive letter) as --recov-device; this may result with lots of false positives/negatives based from the number of wallets that you've used in that partition.
• Create a small partition (about <1GB) from your non-system drive (not C: drive) by "shrinking" it and creating a new partition.
• Grab a small USB flash drive (preferably USB3) to be used as your --recov-device

The simplest is the third option where you can immediately start --recover.
Here's how to:

• Plug your USB Drive and remember the drive letter it's allocated with, let's say it's shown as "F:".
• Paste all of your wallet.dat files inside that flash drive.
• Then open PowerShell with python and pywallet's folder as its working directory (SHIFT-Right-click method)

Then enter this command:

Code:

./python pywallet.py --recover --recov_device=F: --recov_size=16Gio --recov_outputdir=C:\Python27\111recover_folder

You must replace the "--recov_device=<letter>:" and "--recov_size=<size>Gio" based from your Flash Drive's letter and maximum size.

In that same PowerShell window, pywallet will ask you to type a passphrase for the wallet.dat that it'll create (where the keys will be imported).
Next, it will ask you the passphrase(s) of the wallet files in that drive, one passphrase per line (enter), enter a blank passphrase in the next line after typing all the passphrases.
Note: it will not display the passphrase that you've typed for safety purposes.

If the command is successful whether there are keys imported or not, a wallet.dat will be created inside a folder named "111recover_folder" in C:\Python27\ directory.
The result should tell you whether there are private keys imported or not.

[mcdouglasx]

So I have put my wallet.dat file into C Python27 and ran the command in Windowspowershell replacing the passphrase with mine ands the name of my wallet.dat file and it came out with
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
I didn't have anything to do with bitcoin open. Does this mean I have to do the other method as it is corrupted.

Is this wallet old? If you open the file with a text editor you can read something, like, walletdescriptorkey, sqlite? If so, I think pywallet doesn't support it because it uses sqlite and the old ones use berkeleydb.

[Hayesey]

So I have put my wallet.dat file into C Python27 and ran the command in Windowspowershell replacing the passphrase with mine ands the name of my wallet.dat file and it came out with
ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
I didn't have anything to do with bitcoin open. Does this mean I have to do the other method as it is corrupted.

Is this wallet old? If you open the file with a text editor you can read something, like, walletdescriptorkey, sqlite? If so, I think pywallet doesn't support it because it uses sqlite and the old ones use berkeleydb.

The wallet is approximately 13/14 months old, this is the version that the .dat was created in the bitcoin client bitcoin-v25.0.0.

-snip- and it came out with ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.
I didn't have anything to do with bitcoin open. Does this mean I have to do the other method as it is corrupted.

That error shows if pywallet can't lock of the wallet.dat usually if it's being used by Bitcoin Core or another client/program.
But yes, that also appears when pointed to a corrupted wallet file, case-to-case basis.

For the other method (--recover), your options are:

• Use an existing partition (drive letter) as --recov-device; this may result with lots of false positives/negatives based from the number of wallets that you've used in that partition.
• Create a small partition (about <1GB) from your non-system drive (not C: drive) by "shrinking" it and creating a new partition.
• Grab a small USB flash drive (preferably USB3) to be used as your --recov-device

The simplest is the third option where you can immediately start --recover.
Here's how to:

• Plug your USB Drive and remember the drive letter it's allocated with, let's say it's shown as "F:".
• Paste all of your wallet.dat files inside that flash drive.
• Then open PowerShell with python and pywallet's folder as its working directory (SHIFT-Right-click method)

Then enter this command:

Code:

./python pywallet.py --recover --recov_device=F: --recov_size=16Gio --recov_outputdir=C:\Python27\111recover_folder

You must replace the "--recov_device=<letter>:" and "--recov_size=<size>Gio" based from your Flash Drive's letter and maximum size.

In that same PowerShell window, pywallet will ask you to type a passphrase for the wallet.dat that it'll create (where the keys will be imported).
Next, it will ask you the passphrase(s) of the wallet files in that drive, one passphrase per line (enter), enter a blank passphrase in the next line after typing all the passphrases.
Note: it will not display the passphrase that you've typed for safety purposes.

If the command is successful whether there are keys imported or not, a wallet.dat will be created inside a folder named "111recover_folder" in C:\Python27\ directory.
The result should tell you whether there are private keys imported or not.

Just FYI when I try to load the corrupted wallet.dat, bitcoin client tells me the wallet
is in an incorrect format.This is the file i recovered after stupidly deleting it from my D drive.

Im going to be using a USB flash drive as my non system drive, I am unsure if i can shrink the partition on this?
Or does it have to be an actual hard drive

Grab a small USB flash drive (preferably USB3) to be used as your --recov-device. Does this mean i need a second USB drive for the --recov-device drive, i have one if that is the case.
I am just about to try the simplest third method after posting this message thanks

[moderator's note: consecutive posts merged]

[mcdouglasx]

The wallet is approximately 13/14 months old, this is the version that the .dat was created in the bitcoin client bitcoin-v25.0.0.

It is probably a wallet descriptor, these use sqlite and not berkeley.

[Hayesey]

I have got this far but it would not let me type in the passphrase when prompted to 

PS F:\> ./python pywallet.py --recover --recov_device=F: --recov_size=57Gio --recov_outputdir=C:\Python27\111recover_folder
WARNING:root:pycrypto or libssl not found, decryption may be slow
Enter the passphrase for the wallet that will contain all the recovered keys:
Enter the passphrase for the wallet that will contain all the recovered keys (can't be empty):
Enter the passphrase for the wallet that will contain all the recovered keys (can't be empty):

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:
Possible passphrase:

[mcdouglasx]

I have got this far but it would not let me type in the passphrase when prompted to 

PS F:\> ./python pywallet.py --recover --recov_device=F: --recov_size=57Gio --recov_outputdir=C:\Python27\111recover_folder
WARNING:root:pycrypto or libssl not found, decryption may be slow
Enter the passphrase for the wallet that will contain all the recovered keys:
Enter the passphrase for the wallet that will contain all the recovered keys (can't be empty):
Enter the passphrase for the wallet that will contain all the recovered keys (can't be empty):

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:
Possible passphrase:

Pywallet uses bsddb3 (Berkeley DB), which is for legacy wallets. Bitcoin Core 25 uses SQLite by default for wallets instead of the traditional Berkeley DB, although both are compatible a legacy wallet is currently created by editing bitcoin.conf and with a command in the console so I don't think Pywallet will help you since I assume you created your wallet by default.
you should look for tools with wallet descriptor support, or recover an older version of the file, or subject your disk to file recovery software like tesdisc.
what happened that your address got corrupted?

[nc50lc]

The wallet is approximately 13/14 months old, this is the version that the .dat was created in the bitcoin client bitcoin-v25.0.0.

Just as mcdouglasx said, it's a descriptor wallet if it's created by version 23.0 or above (ofc including v25.0).
Unless you specified to create a legacy wallet during wallet creation (which is available in that version).
If you're unsure, proceed with --recover.

Although it's not the cause of the issue explained below, it will not find your private keys using the method used by pywallet's --recover command if it's a descriptor wallet.

Just for clarification, the tool is working correctly:

I have got this far but it would not let me type in the passphrase when prompted to  

There's a note in your PowerShell window regarding that, I've left a note as well:

-snip- enter a blank passphrase in the next line after typing all the passphrases.
Note: it will not display the passphrase that you've typed for safety purposes.

It's not displayed but it's there, just hidden.
Then to proceed, do not type anything in the next "Possible passphrase:" line, just press 'Enter'.

[Hayesey]

I have got this far but it would not let me type in the passphrase when prompted to 

PS F:\> ./python pywallet.py --recover --recov_device=F: --recov_size=57Gio --recov_outputdir=C:\Python27\111recover_folder
WARNING:root:pycrypto or libssl not found, decryption may be slow
Enter the passphrase for the wallet that will contain all the recovered keys:
Enter the passphrase for the wallet that will contain all the recovered keys (can't be empty):
Enter the passphrase for the wallet that will contain all the recovered keys (can't be empty):

Enter the possible passphrases used in your deleted wallets.
Don't forget that more passphrases = more time to test the possibilities.
Write one passphrase per line and end with an empty line.
Possible passphrase:
Possible passphrase:

Pywallet uses bsddb3 (Berkeley DB), which is for legacy wallets. Bitcoin Core 25 uses SQLite by default for wallets instead of the traditional Berkeley DB, although both are compatible a legacy wallet is currently created by editing bitcoin.conf and with a command in the console so I don't think Pywallet will help you since I assume you created your wallet by default.
you should look for tools with wallet descriptor support, or recover an older version of the file, or subject your disk to file recovery software like tesdisc.
what happened that your address got corrupted?

I did create the wallet and named it, but I didn't save it so I recovered the file using recovery software (EASEUS) and the .dat file I recovered when loading it into the bitcoin client comes back with an error message with the wallet being in an incorrect format.

[mcdouglasx]

I did create the wallet and named it, but I didn't save it so I recovered the file using recovery software (EASEUS) and the .dat file I recovered when loading it into the bitcoin client comes back with an error message with the wallet being in an incorrect format.

In that case, please perform a deep scan so that you may be able to recover the file properly.

[Hayesey]

Thanks, I have had a little bit of success, getting it to go through the scan of the Go Reads and here is the result that came through at the end

Traceback (most recent call last):
  File "pywallet.py", line 4034, in <module>
    recoveredKeys=recov(device, passes, size, 10240, options.recov_outputdir)
  File "pywallet.py", line 1713, in recov
    f=open(outputdir+'/pywallet_partial_recovery_%d.json'%ts(), 'w')
IOError: [Errno 2] No such file or directory: 'C:\\Python27\\111recover_folder/pywallet_partial_recovery_1736643639.json'

I also have an additional file named  111dump01.tx  in the directory and files called __db.001 to __db.006

[nc50lc]

Thanks, I have had a little bit of success -snip-
IOError: [Errno 2] No such file or directory: 'C:\\Python27\\111recover_folder/pywallet_partial_recovery_1736643639.json'

Try to manually create a new folder in "C:\Python27", rename it into "111recover_folder".
Then retry the command.

The "little bit of success" is just for using the command though since those "Go" lines will show whether it found keys or not.

I also have an additional file named  111dump01.tx  in the directory

Based from that name, it is from your previous attempt to dump the private keys of your wallet.dat file.
See post number 16: https://bitcointalk.org/index.php?topic=5523169.msg64919347#msg64919347

Since the command ended up an error, that file shouldn't contain anything useful.
(you may open it with notepad/text editor though to check)

-snip- and files called __db.001 to __db.006

Those should be inside your --recov_outputdir=<path>
You must have forgotten to specify a path after the arg above at least in one instance
Because if true, those will be created in your working directory which is "C:\Python27", like so.

[Hayesey]

I'm terribly sorry for no response this week, I have had a very hectic week to say the least and I will be back to it on Saturday 

[Hayesey]

Managed to get some time today and here is the results of the scan

Found 1 possible wallets
Found 6 possible encrypted keys
Found 0 possible unencrypted keys

Possible wallet #1
    with passphrase #1

Private keys not decrypted: 6
Trying all the remaining possibilities (6) might take up to 0 minutes.
Do you want to test them? (y/n): y

The wallet is encrypted and the passphrase is correct


Importing:


The new wallet C:\Python27\111recover_folder/recovered_wallet_1737138914.dat contains the 0 recovered key

The 111recover_folder has a recovered wallet in and some other stuff along with the db.001 to 006 but I'm guessing this is not good result.

[mcdouglasx]

The new wallet C:\Python27\111recover_folder/recovered_wallet_1737138914.dat contains the 0 recovered key
The 111recover_folder has a recovered wallet in and some other stuff along with the db.001 to 006 but I'm guessing this is not good result.

As I mentioned earlier, pywallet is not written to be compatible with wallets descriptor (or at least the versions I've seen).
These are created in SQLite, meaning a separate database. Therefore, pywallet is not useful because, as far as I know, pywallet only searches for offsets for legacy databases that use BerkeleyDB.
Your best option is to search for software for recovering deleted files and deep disk scan for ".dat" files.

[nc50lc]

The new wallet C:\Python27\111recover_folder/recovered_wallet_1737138914.dat contains the 0 recovered key

The 111recover_folder has a recovered wallet in and some other stuff along with the db.001 to 006 but I'm guessing this is not good result.

Yes, "contains the 0 recovered key" isn't good.

As for the results:
"Found 1 possible wallets" is just a result of having a wallet.dat in that recov-device.
Interestingly, it found "6 possible encrypted keys" but since pywallet is looking for very short "magic bytes",
The chance that it just found false-positive match on an incompatible wallet is high.
This is why it can decrypt the wallet's mkey with "the wallet is encrypted and the passphrase is correct" but failed to decrypt the "possible" private keys which are most likely not private keys.

Your other option now is Bitcoin Core's "bitcoin-wallet" tool's salvage feature. (the command line tool is in your 'bin' or 'daemon' folder inside Bitcoin's install directory)
Take note that its success is based from how badly corrupted your wallet is and if the important data are intact.
However, that salvage command isn't currently compatible on descriptor wallets, but it should be in near future since Bitcoin Core will ditch the old wallet version in the next major release.
Or you try to post a "feature request" issue in bitcoin's GitHub Repo if no one posted the same request before.

[Hayesey]

Hi sorry for the long wait. I have been trying different wallet.dats that I have been finding then using the recovery method and I have found this,

The new wallet C:\Python27\111recover_folder/recovered_wallet_1737671199.dat contains the 4103 recovered keys

Quite a surprise to me as I have never seen the scan go this far and it has never came back with this answer nor has it gone to the importing keys stage so it looks hopeful on this side. Is this a step in the right direction?

[mcdouglasx]

Hi sorry for the long wait. I have been trying different wallet.dats that I have been finding then using the recovery method and I have found this,

The new wallet C:\Python27\111recover_folder/recovered_wallet_1737671199.dat contains the 4103 recovered keys

Quite a surprise to me as I have never seen the scan go this far and it has never came back with this answer nor has it gone to the importing keys stage so it looks hopeful on this side. Is this a step in the right direction?

First, try loading the wallet in Bitcoin Core. If it gives an error, you can try opening the file with a text editor and look for any readable text within it. Since you created the wallet with Electrum v25, it's likely to be in SQLite format. Try searching within the file for readable text such as walletdescriptorkey, internalspk name, and even if you can visualize addresses. This will give you clues if the file belongs to a real wallet.

[nc50lc]

The new wallet C:\Python27\111recover_folder/recovered_wallet_1737671199.dat contains the 4103 recovered keys

Quite a surprise to me as I have never seen the scan go this far and it has never came back with this answer nor has it gone to the importing keys stage so it looks hopeful on this side. Is this a step in the right direction?

You didn't specify the steps on how it finished with that different result but it means that the created "recovered_wallet_1737671199.dat" contains private keys.
The next step is to Open Bitcoin Core and load that wallet via "File->Restore Wallet..." menu.
With that, Bitcoin Core will copy that wallet and create a specific directory with the name of your choice, let it rescan to check for balance.
I recommend to set-up a non-pruned Bitcoin Core node so that you can rescan without needing to redownload the blockchain everytime.

If you used your other drive as --recov-device aside from the flash drive where the corrupted wallet.dat is,
Chances that those are just keys from your other existing or deleted wallet.dat files from that drive, including TestNet, RegTest and Altcoin wallet files.
(it's worth the try while waiting for other viable options though)

[Hayesey]

I have a fully updated un pruned bitcoin core that is trying to restore the wallet it is taking a very long time and will post the results as soon as possible, at least it hasn't failed

Hi sorry for the long wait. I have been trying different wallet.dats that I have been finding then using the recovery method and I have found this,

The new wallet C:\Python27\111recover_folder/recovered_wallet_1737671199.dat contains the 4103 recovered keys

Quite a surprise to me as I have never seen the scan go this far and it has never came back with this answer nor has it gone to the importing keys stage so it looks hopeful on this side. Is this a step in the right direction?

First, try loading the wallet in Bitcoin Core. If it gives an error, you can try opening the file with a text editor and look for any readable text within it. Since you created the wallet with Electrum v25, it's likely to be in SQLite format. Try searching within the file for readable text such as walletdescriptorkey, internalspk name, and even if you can visualize addresses. This will give you clues if the file belongs to a real wallet.

Is notepad good enough or which text editor do you recommenced. I will do this if the file fails to load.

[mcdouglasx]

I have a fully updated un pruned bitcoin core that is trying to restore the wallet it is taking a very long time and will post the results as soon as possible, at least it hasn't failed

That's a good sign, I hope you figure it out.

Is notepad good enough or which text editor do you recommenced. I will do this if the file fails to load.

Any text editor will do, the important thing is to find readable text that tells you the presence of wallet.dat variables that bitcoin does not hide, as I mentioned above, search: walletdescriptorkey, internalspk name, addresses, xpub, external, ckey.

There is no need to copy anything here, for privacy reasons and to avoid leaking sensitive data.