Recovering private keys from a wallet.dat file

[Hayesey]

It took around 6 hours to load the wallet and there is nothing there, i have not tried text editor yet. Do you recommend any recovery software as I want to go back on to the old hard drive and recover it with a different software to see as it says that it is in incorrect format at the moment.

[mcdouglasx]

It took around 6 hours to load the wallet and there is nothing there, i have not tried text editor yet. Do you recommend any recovery software as I want to go back on to the old hard drive and recover it with a different software to see as it says that it is in incorrect format at the moment.

There are many software programs for recovering deleted files, such as TestDisk, Recuva, DiskDrill, and Data Recovery. Only download official software with caution(avoid malware). It would be convenient to use one that searches by file extension, so you can look for files with the ".dat" extension specifically. During the search, you should perform a deep scan, as a simple scan might miss your file.

[Hayesey]

oaky will do thanks.

so when i got the notification of the restore wallet failed, its said     data is not in recognized format.

Could it be the recovery software is the issue or is it that I didn't save the wallet.dat when I deleted the Bitcoin Core from my 'D' drive?

[mcdouglasx]

so when i got the notification of the restore wallet failed, its said     data is not in recognized format.

Could it be the recovery software is the issue or is it that I didn't save the wallet.dat when I deleted the Bitcoin Core from my 'D' drive?

The thing is that pywallet doesn't actually look for wallet.dat files, it looks for offsets that could be useful in identifying possible data belonging to a wallet.dat file. It is possible that you will find false positives, whereas a file recovery software might be more accurate.

[Hayesey]

Sorry for not being active recently, I am  going to use Disk Drill & have downloaded it from the official site. Thanks for the info.

[nc50lc]

Sorry for not being active recently, I am  going to use Disk Drill & have downloaded it from the official site. Thanks for the info.

Just one important note regarding that, since you mentioned that you've deleted Bitcoin from D:/
Do not write anything (like Copy-Paste or create any file) to that drive anymore including installation of any software to D:/
Because once a data is overwritten to the sectors where the possible wallet.dat is located, you will not be able to restore it without data corruption.

If the possible wallet.dat is in your C:/ drive instead (e.g. default Bitcoin datadir),
Use a separate PC to install that recovery software and mount that drive there instead (and also don't write anything to it or use it to boot)
That's because the OS is actively using that system drive and the data that you want to recover could be overwritten in every second that you're using it.

If you're unsure where the deleted wallet.dat was, it's safer to use another PC to install the software and just mount your drives there.

[Cricktor]

~~~

Very true. To avoid overwriting data regions on a storage device where you have (accidently) deleted some important data and need to recover that, you should as soon as possible or better immediately stop the OS from writing any further data to this storage device.

I would go so far to recommend to hard-unplug the storage media (if external) or hard-shut-off the computer if it's an internal storage drive, then remove the internal drive from the computer before you restart it. You must avoid at all cost any further writes to a drive where you want to restore deleted data! This can cause damage to the filesystem(s) but any overwritten data is usually lost unless you have backups.

I don't know if you can tell Windows to mount a drive or partition read-only. MacOS (via command-line, I guess) and Linux can mount filesystems read-only which is preferred so to not alter the filesystem in any negative way, i.e. avoid overwriting freed data regions of deleted files and/or folders.

Make a forensic master copy of your read-only mounted storage media; only work on copies of such a forensic master copy for any data recovery procedure.

[Hayesey]

Thanks for the Info, i have found more wallet.dats from another place so I am currently going through the process of recovering them and then putting them into bitcoin core. It will take along time because of the amount of wallet.dats and then each one in bitcoin core takes 6 hours.   

Thank you

[nc50lc]

It will take along time because of the amount of wallet.dats and then each one in bitcoin core takes 6 hours.

If there's actually a lot of wallets to rescan that will take you more than a week to a month to finish:
You may consider loading those all to a fresh Bitcoin Core, pointed to a different datadir or on another PC.
Then let it sync so all of the wallet files would be scanned at the same time as Core syncs.

If the internet and specs are good, it shouldn't take too long to sync.
(estimate if it would be faster than your approximate time if it's done manually)

[Hayesey]

Its been a long time and I have almost finished with the wallet.dats and I'm just wondering about what you said about putting them together as one and then using bitcoin core, I am just wondering how I would do that if anyone has an answer it would be greatly appreciated. Thanks.

[Cricktor]

You can open Bitcoin Core when the device is offline with a new datadir set (so that the blockchain is empty and no sync has started yet) and load all wallets one after the other. Core doesn't do much with every loaded wallet as it recognizes that it's offline and not connected to the network. This way you can have one, two or twenty or more wallets opened and loaded in Core.

If you don't close any of the loaded wallets, Core will remember to re-open them all when you restart it with your device connected to internet. Then a new blockchain sync can start (or you tell Core to resync) and all wallets are synced in parallel which will likely be faster than a resync every time you load a new wallet.

[nc50lc]

Its been a long time and I have almost finished with the wallet.dats and I'm just wondering about what you said about putting them together as one.

Not "as one" but all wallets can be loaded without having to rescan each time if there's no blockchain yet to scan.

Here:

You may consider loading those all to a fresh Bitcoin Core, pointed to a different datadir or on another PC.
Then let it sync so all of the wallet files would be scanned at the same time as Core syncs.

What I mean by "Fresh Bitcoin Core" is: it's either newly installed or has not yet synced.
So you can either set a new datadir or do it on another machine that you haven't used Bitcoin Core.

"Loading" is self-explanatory, but if you've done it on a fresh Bitcoin Core, it will load fast since there's no blockchain to rescan.

After loading all of the wallets, you should see all those in the GUI's drop-down menu on the right.
Sync Bitcoin Core and all of those wallets will be scanned simultaneously as bitcoin core syncs.
If you've done this, it would only take about the same time as your first time syncing Core, not more than a month.