Need help plz

[Boss3010]

Hello guys , I mined bitcoin in 2009 or 2010 don’t remember when exactly and I forget about it . Now I am trying to find it in my old hard disk and I found gpg file but I can’t find the private rsa key to decrypt it . I analyzed the file and found the encrypted date is 6000 bits and I need a private rsa key with specific id key and my file is 165 MB , so my question is there any programs u tried can let me view the unencrypted part of the data or any tools u tried, and what is my options here .

[apogio]

So you have something (a file) encrypted with GPG and you want to see what's encrypted?

There is no way, unfortunately.

Some ideas:
1. the file name. If it says passwords.txt.asc it has passwords, if it says blabla.pdf.asc it contains blabla.
2. run gpg --list-packets <filename>. It should show you what encryption algo was used, if it was symmetric or asymmetric. In general it shows metadata, but not clues about what was included in the file.

[ABCbits]

Now I am trying to find it in my old hard disk

1. Have you made RAW copy/backup of your old hard drive? It's important to prevent any deleted data accidentally overwritten.
2. Have you tried using file recovery software to look for any deleted data?

I analyzed the file and found the encrypted date is 6000 bits

You need to explain this part better, since 6000 bits probably refer to length of RSA keys or size of encrypted data rather than date.

and I need a private rsa key with specific id key and my file is 165 MB

165MB file? What kind of file you're talking about? I'm sure Bitcoin-qt and wallet file generated by Bitcoin-qt have smaller size.

[Boss3010]

Honestly, I searched through my old hard drive but couldn’t find anything useful. So, I decided to use some data recovery tools, and fortunately, one of them managed to recover a .gpg file—although it was restored with a random name. The file is 165 MB in size and has a .gpg extension.
I ran a full strings scan on it, and it was filled with keywords like “btc”, “wallet”, “xprv”, “priv”, and “key”. I also noticed the beginnings of old Bitcoin addresses. However, all the matches were small fragments—no complete sentences or full addresses.
Then I used the gpg --list-packets command to analyze the file structure. It showed that the file is encrypted using RSA (Key ID starting with 5EB…), with algorithm 3 and an encrypted data packet of length 6284 bytes.

[apogio]

Honestly, I searched through my old hard drive but couldn’t find anything useful. So, I decided to use some data recovery tools, and fortunately, one of them managed to recover a .gpg file—although it was restored with a random name. The file is 165 MB in size and has a .gpg extension.
I ran a full strings scan on it, and it was filled with keywords like “btc”, “wallet”, “xprv”, “priv”, and “key”. I also noticed the beginnings of old Bitcoin addresses. However, all the matches were small fragments—no complete sentences or full addresses.
Then I used the gpg --list-packets command to analyze the file structure. It showed that the file is encrypted using RSA (Key ID starting with 5EB…), with algorithm 3 and an encrypted data packet of length 6284 bytes.

I don't suppose you can go anywhere from this point. The point of encrypting something with RSA (using GPG as a tool), is to not be able to open it without the password.

RSA encryption is asymmetric. Which means that in order to decrypt the file you will need the private key.

The private key lives inside the hosting machine, where GPG was installed (most of the time).

If (I repeat if), the disc that you have in your hands was the same disc where the OS was installed, or if by chance you have saved the keys in the same disc, there may be a chance to find it.

I would search for .gnupg in the old disc. If there is any key material there, you may find it this way. But there is a catch. You will need to know the password, which is a very difficult task to accomplish 15 years later.

[DaCryptoRaccoon]

You should make a back up of the file before trying anything on it
this is always advised just incase something happens.

If you think you know the password you could try decrypt the file and output the contents with

Code:

gpg --decrypt recovered_file.gpg > output_file

You could also give this command a go see if there is a secret key for the file

Code:

gpg --list-secret-keys

If the file was encrypted with a symmetric cipher (passphrase only, no public/private key),

Code:

gpg --decrypt --symmetric recovered_file.gpg > output_file

If you still have no luck you could try export the packets and see if they hold any additional information

Code:

gpg --list-packets --verbose recovered_file.gpg > packet_dump.txt

Another good solution is PGPDUMP

Code:

pgpdump file -l -i -m- p  < options are for showing additinal information from the file >

If you have or can recover the private key associated with the key ID (5EB…)

Code:

gpg --decrypt --recipient-key 5EB… recovered_file.gpg > output_file

If you still unsure you could try bruteforce it with gpg2john

gpg2john recovered_file.gpg > hash.txt
john hash.txt

This will convert the GPG file’s passphrase hash into a format compatible with John the Ripper for brute-forcing.

Good luck!

[eb66]

Hello guys , I mined bitcoin in 2009 or 2010 don’t remember when exactly and I forget about it . Now I am trying to find it in my old hard disk and I found gpg file but I can’t find the private rsa key to decrypt it . I analyzed the file and found the encrypted date is 6000 bits and I need a private rsa key with specific id key and my file is 165 MB , so my question is there any programs u tried can let me view the unencrypted part of the data or any tools u tried, and what is my options here .

Is the gpg file something you created?

I suggest looking for the original wallet file, or a backup of it, on that disk .. you'll have more luck with that than trying to open a gpg file without the private key.

Try reaching out to Dave at walletrecoveryservices.com - he has helped many people in this situation.

[DannyHamilton]

Did you purchase this file from someone? If so, how much did you pay?

(I've been on this forum WAY too long. I'm getting cynical in my old age)

[Cricktor]

So, I decided to use some data recovery tools, and fortunately, one of them managed to recover a .gpg file—although it was restored with a random name. The file is 165 MB in size and has a .gpg extension.
I ran a full strings scan on it, and it was filled with keywords like “btc”, “wallet”, “xprv”, “priv”, and “key”. I also noticed the beginnings of old Bitcoin addresses. However, all the matches were small fragments—no complete sentences or full addresses.
Then I used the gpg --list-packets command to analyze the file structure. It showed that the file is encrypted using RSA (Key ID starting with 5EB…), with algorithm 3 and an encrypted data packet of length 6284 bytes.

Which data recovery tools did you use?

I would assume that an encrypted file with extension .gpg doesn't really have any meaningful strings in it. It's all encrypted, isn't it?

Your data recovery tool may have found chunks of data, possibly from a wallet.dat file, and attributed it to be a GPG file because it found chunks of encrypted data. It's possible that what your recovery tool found isn't quite correct. But I'm just speculating a bit based on what you provided.

I guess there's not much you can do, if you can't remember having created a GPG file, haven't documented anything about it and most importantly haven't documented any decryption details. Having no backups of wallet files is a somewhat common problem of early bitcoiners (don't want to lump everyone together; those who have don't show up in the forum with recovery issues).


If you're searching for valuable data, make sure you don't alter the storage media, especially when you have to assume to recover potentially deleted files from some filesystems. I would highly recommend to make forensic bit-by-bit copies of storage media (read-only access to the storage media devices) and work only on copies of such forensic copies. The basic principle is to never alter the original storage media.

(I've been on this forum WAY too long. I'm getting cynical in my old age)

In many cases your assumption isn't wrong...