EPIC fail

[NINJA--]

My computer was giving me blue screens today. Had to re-install OS. I couldnt get to my desktop to retrieve my BTC folder. I thought I was safe cause I have a backup on a second HD and on flash USB. But my backup HD is also giving me problems. Computer wont boot with it plugged in. Tried connecting it through an external USB HD enclose too. No luck. HD might be fucked. So I plug in my USB stick copy my BTC folder back over to my fresh install and when I try to launch my wallet I get these error messages and my wallet shuts down. I had 600 coins in my wallet. Please, help me.


this application has requested the runtime to terminate it in an unusual way. please contact the applications support team for more information.

cannot obtain a lock on data directory C/users/ninja/appdata/roaming/bitcoin bitcoin is probably already running.

[1714223251]

1714223251

[1714223251]

1714223251

[ineededausername]

Your wallet's fine.  Instead of moving the entire folder, let an empty wallet sit there and download the blockchain first, THEN move only the wallet in.  For some reason, Bitcoin didn't release the lock on the appdata folder.
edit: Also, when dealing with a large amount of coins like that, don't trust the backup.  The easy solution is to use a Ubuntu liveCD, mount the XP drive and move the files out to a USB. 

[trentzb]

Your wallet's fine.  Instead of moving the entire folder, let an empty wallet sit there and download the blockchain first, THEN move copy only the wallet in.  For some reason, Bitcoin didn't release the lock on the appdata folder.
edit: Also, when dealing with a large amount of coins like that, don't trust the backup.  The easy solution is to use a Ubuntu liveCD, mount the XP drive and move the files out to a USB. 

FTFY

[NINJA--]

I tried from another computer. I let it load then I coped wallet.dat to folder. Wallet wont launch. Error message then shut down.

[ineededausername]

Error message? What error?

[NINJA--]

this application has requested the runtime to terminate it in an unusual way. please contact the applications support team for more information.

[grue]

this application has requested the runtime to terminate it in an unusual way. please contact the applications support team for more information.

did you delete %appdata%/bitcoin/ first?

[payb.tc]

which version are you using?

maybe try with an older copy like 0.4.1.1

[NINJA--]

Was using 5.0.1 and I just tried 4.0 my wallet refuses to launch with my wallet.dat file in the folder.

[CIYAM]

I think it may be problematic running the older version (as the Berkley DB version changed sometime recently).

Have you tried starting up your 0.5 version with the "-debug" option?

You might be able to find out more detail about what the problem is (the file "debug.log" hopefully would contain something useful after the crash occurs).


Cheers,

Ian.

[NINJA--]

I have not tried starting with debug. How do I do that?

[CIYAM]

I have not tried starting with debug. How do I do that?

If you click on Start -> Run and then type: %ProgramFiles%\Bitcoin\bitcoin.exe -debug

then this should do the job.

The file "debug.log" should appear in the same folder as your wallet (assuming you are using the normal folder for that).


Cheers,

Ian.

[casascius]

I can recover the BTC from a wallet regardless of damage, because I ignore the Berkeley DB and just yank the private keys out at the hex level.

Let me know if you would like me to try.  My e-mail is mcaldwell@mc2cs.com.  Send me a bitcoin address where you would like to receive the proceeds.  My process takes under 10 minutes.  PGP is a good idea if you know how.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: SKS 1.1.0

mQENBE2831kBCADWf5Sx4+FnwZTDuVdz0AngaMd9DxrsdsjeV7FvViLxI3eJ5EkayxICVGle
9TQWpLfxgViUyfn3okC7Lf4q1x54sERvCLwkbHWlRKV71YvTg4zRDrOps3g4l6yyMyZR0YDL
oRx5V6ZhmWr8J8yw6ijk1JYW8RRUUBP3epOPJuz4waiPsey3CWvhSmWCJLe1C0EyPOo1or4N
LGDbPV+Kkrc5H5j/jZG7CB7zzLH7m5uvyHQ4u3DL0zPmMcxxvIKVvDlu+ij9kMveZvI0atHu
XfzT2hzw+wr1lWPSF0ZhG0qAXHsqHBdK8z2My8km+tGclmVjJdTi/AE4uRF/oG9apTd5ABEB
AAG0KE1pa2UgQ2FsZHdlbGwgPG1jYWxkd2VsbEBzd2lwZWNsb2NrLmNvbT6JATgEEwECACIF
Ak2831kCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFou6PHxF1oj8X0IANOnpM+r
7n35qLBiXeUc8VC/9Q/KLhHyawRC4+k6Ic1QYqTVvIpsEDQVlD5I750KoK6EpwM2ObvEvF0V
Q2K70AZ0JgadvkyV0vFcniODD25mEgT/WqzSK+YbIxre2Q1BewKlR08hz9fLAzhpAGJXkUro
c5hjxsy5txMJa2Y8FW0kcyt9exm2ZOIel5VJYF+BnUXqyGsswEMXFDBtBLIEU+gHVBVSWFp7
P/KWDGPL1OUr2vH6JYqJPAeSWEMOReBwk8Ow8e7WsP3xEGBXyIiGTYRZRjglJUfo3sA1e6xo
qQV6VYv6tQ2/h5CTZiEr4MShW4NU8F/BVIqN6ccY5RJ8NOe5AQ0ETbzfWQEIAJln4sMEuf62
jiONkUKpjP8LobHTPZYVmy51Ynk+1LdbyZwQpIzefCqU7fMP/SGcWZWcJzqS5uTP8tIisU2N
CgjD3CqUokvooMWxCQDWJAT2VMynAsIqliE5XjcnJDZdCQ6PtU5NHZ/2lOS1Gu/6x8WdzrOf
/5SuopW3E703qGJr5LnV0rBl+FWaeKv0edDy3aBn+cGIU3lQMVlCTQj6+kPdpr5Vc2ds87Eu
jjjDad3aSRAvJn8l5xzHtQlCE1TT4JIo1uSnFaX7Fy1ecsExpC7SQy23QubGHZKzrM/9+nQ+
3RKNU/QK2dO6g6CHTEnUjK8odxc66vYyrlOpRvASouUAEQEAAYkBHwQYAQIACQUCTbzfWQIb
DAAKCRBaLujx8RdaI90HB/96fo7tlMrk2kYzw60W/uiykYT8VFN0ozmohbq9xz3ORqoap1rD
owi9NMVpVVpnz5PL2Kc0PT8IAH+XPotvuz7/YV3RkUoUcNWr/KfEc5uz09CSE2ILg0503xek
g5n97Lxwcx2nx3jdmGASWNEFBfHHLhXf+mci7ZRrtevvnmasTiYXHhtjWgn7CmPBd/XthP1d
hcQIt7KjSYjBidTYlANPlwa2CimGxSh4x6CAwfL1KlMQO2Sa0fK0EhkTCVmhE3JaFp+BL4Kn
lAdcsvcfnBobCulIa6eNmOr9H9BS8Ut2y++wBjhe0oz2aFLJ9YgeDm1W7yy71xiZLsAml1Nt
qogK
=V551
-----END PGP PUBLIC KEY BLOCK-----



EDIT: note: I can't read an encrypted wallet.  This only works if the keys are not encryped... also, if you don't get anywhere and decide to give me a whack at it, please contact me first and make sure I'm around before sending anything, would prefer not to have something like that sitting in my email

[flaxceed]

I'm having the same problem as Ninja.  My debug log says:

EXCEPTION: 22DbRunRecoveryException       
DbEnv::open: DB_RUNRECOVERY: Fatal error, run database recovery       
C:\Program Files\Bitcoin\bitcoin.exe in AppInit()       

and

EXCEPTION: 11DbException       
Dbc::get: Bad address       
C:\Program Files\Bitcoin\bitcoin-qt.exe in Runaway exception       

and

EXCEPTION: 11DbException       
Dbc::get: Bad address       
C:\Documents and Settings\netbook\Desktop\bitcoin-0.5.1-win32\bitcoin-qt.exe in Runaway exception       


Can anyone clue me in to what is going on?  The client just won't start- and it happened out of the blue. 

[NINJA--]

I tried %ProgramFiles%\Bitcoin\bitcoin.exe -debug i get this message:  windows can not find   C:\program  make sure you typed the name correctly and try again

[Sannyasi]

You could just make a shortcut to your bitcoin.exe then right click and go to properties. Add '-debug' to the end of the target and use that shortcut. I'm not sure if it will work though but might be worth a shot

[NINJA--]

I just tried. Wallet wont load. Same error message.

this application has requested the runtime to terminate it in an unusual way. please contact the applications support team for more information.

[CIYAM]

I tried %ProgramFiles%\Bitcoin\bitcoin.exe -debug i get this message:  windows can not find   C:\program  make sure you typed the name correctly and try again

Oops - my bad - should have been "%ProgramFiles%\Bitcoin\bitcoin.exe -debug" (i.e. with quotes).

In any case if you are also seeing:

EXCEPTION: 22DbRunRecoveryException       
DbEnv::open: DB_RUNRECOVERY: Fatal error, run database recovery

then I guess the debug.log is not really of that much help as I assume that is just saying it can't open a DB because it thinks it is corrupt.

I am guessing there is probably some sort of DB recovery tools out there (a quick search found me http://pybsddb.sourceforge.net/ref/transapp/recovery.html) but I've never played around with Berkeley DB myself and so am not sure exactly whether it would help or not. If the problem was just that file closure didn't occur correctly then I'd assume such a recovery tool should be able to fix things up but if the problem was more serious then it will probably do nothing to help at all.

In any case make sure you've kept a copy of all original files before playing with any such tools!


Cheers,

Ian.

[flaxceed]

Any suggestions for me?

[NINJA--]

I was reading that link about recovery. It says......

non-catastrophic or normal recovery. If the failure is non-catastrophic and the database files and log are both accessible on a stable filesystem, run the db_recover utility without the -c option or call the DB_ENV->open function specifying the DB_RECOVER flag. The normal recovery process will review the logs and database files to ensure that all changes associated with committed transactions appear in the databases, and that all uncommitted transactions do not appear.

Im suppose to run the utility and use command DB_recover right? How do I access the utility?

[CIYAM]

Im suppose to run the utility and use command DB_recover right? How do I access the utility?

I gather that Berkeley DB is included with many (most?) Linux distros so from a console I can type the command: db_recover

If you are not running Linux then you may be able to find the relevant utility here: http://www.oracle.com/technetwork/database/berkeleydb/downloads/index-082944.html

You need to make sure it is the correct version (I think I had read something about Bitcoin changing to Berkeley DB 4.8 a while back).

I assume then you would simply open a command prompt and change to the Bitcoin app data path and type "db_recover" (with whatever path prefix might be needed).

Once again I have never used Berkeley DB nor played with any of the Bitcoin source so advice from anyone that has more relevant experience should be better trusted than my own.


Cheers,

Ian.

[CIYAM]

I just read the following advice on another similar thread:

1. Make sure you have a backup of the wallet.dat
2. delete all files except wallet.dat from the APPDATA\bitcoin directory (not using windows, but I think you should be able to find it)
3. start bitcoin-qt.exe then wait for the block chain to download..a few hours if I recall correctly

Apparently this worked for the other user with a similar problem to yours so maybe give this a go (be sure to backup everything you are going to delete just in case).


Cheers,

Ian.

[NINJA--]

I already tried deleting everything from folder and letting chain load. Doesnt help.

I just installed ubuntu on a spare HD hoping this is a windows problem and I can get to my coins with ubuntu. I have the wallet installed and the chain downloaded but Im not sure where to put my wallet.dat file. A google search says copy it to ~/.bitcoin/wallet.dat but I dont know where that is. I tried to search for it with the standard search bar and the terminal but couldnt find that location. Ive never used linux before so Im not sure where to look.

[legolouman]

I'm beginning to think your wallet is corrupted. Try putting the 2nd HDD (the one that is failing,but has a backup) into the freezer for a few hours. That should temp fix the HDD, and let you access the wallet.

[CIYAM]

I already tried deleting everything from folder and letting chain load. Doesnt help.

Ouch - that's not good.

A google search says copy it to ~/.bitcoin/wallet.dat but I dont know where that is.

In bash the ~ is short for the "home" folder so for example if I do ls ~/*.txt on my Linux box it would be identical to ls /home/ian/*.txt.

So I'd expect there to be a .bitcoin directory below the home directory of the user that you used to install Bitcoin (if I used "ian" then on my machine then the full path would be /home/ian/.bitcoin/wallet.dat).

I tend to agree with legolouman that things are not looking good with this wallet file (i.e. I seriously doubt it will work by just moving the file to Linux).


Cheers,

Ian.

[NINJA--]

Hey mike, you said you can handle this in 10 minutes. Can you please tell me what to do?

[legolouman]

Hey mike, you said you can handle this in 10 minutes. Can you please tell me what to do?

I don't think he can actually do it regardless of damage. And 600 BTC seems like a lot or private keys involved. Try the freezer trick!

[NINJA--]

Western digital is going to try and recover my data off the drive. I have important stuff on that drive besides the wallet file. I think Im going to let them do what they do before I stick it in the freezer.

[fred0]

I already tried deleting everything from folder and letting chain load. Doesnt help.

I just installed ubuntu on a spare HD hoping this is a windows problem and I can get to my coins with ubuntu. I have the wallet installed and the chain downloaded but Im not sure where to put my wallet.dat file. A google search says copy it to ~/.bitcoin/wallet.dat but I dont know where that is. I tried to search for it with the standard search bar and the terminal but couldnt find that location. Ive never used linux before so Im not sure where to look.

Using ubuntu, ctrl-H will show hidden files in the file manager.

.bitcoin is a hidden directory in your home directory, wallet.dat goes there.

Hard drive failures are a PITA!

[NINJA--]

Bitcoin version 0.5.1-beta
Default data directory C:\Users\NINJA\AppData\Roaming\Bitcoin
Bound to port 8333
Loading addresses...
dbenv.open strLogDir=C:\Users\NINJA\AppData\Roaming\Bitcoin/database strErrorFile=C:\Users\NINJA\AppData\Roaming\Bitcoin/db.log
Loaded 0 addresses
 addresses               110ms
Loading block index...
000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f
000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f
4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b
CBlock(hash=000000000019d6689c08, ver=1, hashPrevBlock=00000000000000000000, hashMerkleRoot=4a5e1e4baa, nTime=1231006505, nBits=1d00ffff, nNonce=2083236893, vtx=1)
  CTransaction(hash=4a5e1e4baa, ver=1, vin.size=1, vout.size=1, nLockTime=0)
    CTxIn(COutPoint(0000000000, -1), coinbase 04ffff001d0104455468652054696d65732030332f4a616e2f32303039204368616e63656c6c6f7 2206f6e206272696e6b206f66207365636f6e64206261696c6f757420666f722062616e6b73)
    CTxOut(nValue=50.00000000, scriptPubKey=04678afdb0fe5548271967f1a67130)
  vMerkleTree: 4a5e1e4baa
SetBestChain: new best=000000000019d6689c08  height=0  work=4295032833
 block index              20ms
Loading wallet...


************************
EXCEPTION: 11DbException       
Db::open: Invalid argument       
C:\Program Files (x86)\Bitcoin\bitcoin-qt.exe in Runaway exception       

[casascius]

Hey mike, you said you can handle this in 10 minutes. Can you please tell me what to do?

I don't think he can actually do it regardless of damage. And 600 BTC seems like a lot or private keys involved. Try the freezer trick!

If you can get a wallet.dat off the machine, send it my way, encrypted if possible, but otherwise, making sure I'm there and responsive before you do.

Sure, sending your wallet.dat to somebody else puts you at risk of them scamming you.  I think I'm well known enough that that shouldn't be a concern.  By the same token, I could theoretically scam all the holders of my physical coins for 32k btc (http://casascius.appspot.com) but I don't.

If you want to know what I'm going to do ahead of time, I am going to: 1-scan the file you give me for the byte sequence 0x04 0x20, 2-grab the 32 bytes after each occurrence, 3-try to use that as a private key 4-import it into a new wallet. 5-do a rescan (which is what takes up to 10 minutes), and 6-send you the balance.  If you're able, you're welcome to take a whack at it yourself.

note that my method doesn't require Berkeley DB to be able to understand anything in the file - part or all of your file could be bad and it doesn't matter - I am just hunting down private keys out of the file and trying them all to see what's on them.

[NINJA--]

Any way you can tell me what to do? If this process is a simple as you say it is I should be able to handle it if you give me instructions. I would like the experience so I know what to do if this happens again. I will tip generously.

[casascius]

Any way you can tell me what to do? If this process is a simple as you say it is I should be able to handle it if you give me instructions. I would like the experience so I know what to do if this happens again. I will tip generously.

Doing what I do the way I do it requires my customized copy of bitcoind (which I run under Linux), as well as a custom program I wrote in C# (Microsoft Visual Studio 2010).  It's simple for me because I will just run my own code already prepared to do it.  If you want to reproduce what I've done, give me an idea of your programming experience level so we're speaking the same language.

In short, my modifications to bitcoind are to include sipa's importprivkey patch, modified to allow me to defer the blockchain scan to a later time of my choosing, so I can import unlimited private keys without needing to wait 5-10 minutes for each one to import.

[NINJA--]

I have no programming experience but Im not computer illiterate and I can follow directions.

[casascius]

I have no programming experience but Im not computer illiterate and I can follow directions.

To the extent those directions are to modify source code to a computer program and recompile it, I'm afraid I can't help much.

I believe someone else published a private key recovery tool for Linux that can scan a whole file system, intended for people who deleted their wallet.dat.  I don't remember what it is called.  I provided input as to how the tool could work, basically it searches the entire disk for byte sequences associated with bitcoin wallets, and then looks for 0x04 0x20 and attempts to grab keys.  It's been a while and I've never had to use it, otherwise I might remember the name.  But it should be able to work on a single wallet.dat file the same way it could work on a whole file system.

[NINJA--]

What do you mean you cant help much? You cant help me do it or you cant do it either? Have you done this before?

[casascius]

What do you mean you cant help much? You cant help me do it or you cant do it either? Have you done this before?

I think you imagine the directions are going to be "click here, open this, type that".

No, the directions are going to be: Use git to clone a copy of the bitcoin source code, apply the sipa wallet patch, make a couple certain modifications to eliminate his wallet rescan, then recompile.  Get casascius bitcoin utility from github, add (some code), compile.

Can you do this?  I suppose what I mean is, teaching someone how to apply a source code patch and compile it into Bitcoin from scratch is beyond the scope of what I'm willing to do, time wise.  In fact, I have already explained in technical terms what needs to be done (with reference to the 0x04 0x20 and the 32-bytes that follow) and if that doesn't make sense to you, you probably will need assistance trying to duplicate what I have done - which is to have done custom programming.

My way isn't the only way though.  I have also been saying that I believe somebody has already created a utility that likely does the exact same thing my programming does: you may be better off trying to find it here in the forums than to build it yourself.

I found a link to it.  https://bitcointalk.org/index.php?topic=25091.0

Another thread I started on this same subject: https://bitcointalk.org/index.php?topic=22697.0

[trentzb]

If you want coins back I would encourage you to ask Mike nicely to do it for you in exchange for a generous reward. He has recovered others' although I am sure you know there is no guarantees.

Alternately git those sources and start hacking

[NINJA--]

I know what you mean. I have people ask me for help with computers and its often difficult explaining things to them. You can tell them 10 times but they dont understand like you do. Like when I was trying to find the location of my wallet.dat on ubuntu. I looked up the location and had the command ~/.bitcoin/wallet.dat but I still didnt know what to do with it. Would be nightmare trying to walk me through this. Especially on a OS I know nothing about. Its not impossible but I can understand why you dont want to.

Im going to be honest. Ive been fucking with this for days. I dont know what else to do. Im desperate. I would appreciate you taking a stab at it but Im sure you understand why I would rather do it myself. Ive spent all this money on equipment and had all this stuff running day and night for months. Its hard handing my wallet over to somebody on the forums. You said your way isnt the only way. What other options do I have? I would like to do everything I can before I hand over my wallet.

[payb.tc]

I know what you mean. I have people ask me for help with computers and its often difficult explaining things to them. You can tell them 10 times but they dont understand like you do. Like when I was trying to find the location of my wallet.dat on ubuntu. I looked up the location and had the command ~/.bitcoin/wallet.dat but I still didnt know what to do with it. Would be nightmare trying to walk me through this. Especially on a OS I know nothing about. Its not impossible but I can understand why you dont want to.

Im going to be honest. Ive been fucking with this for days. I dont know what else to do. Im desperate. I would appreciate you taking a stab at it but Im sure you understand why I would rather do it myself. Ive spent all this money on equipment and had all this stuff running day and night for months. Its hard handing my wallet over to somebody on the forums. You said your way isnt the only way. What other options do I have? I would like to do everything I can before I hand over my wallet.

ninja, do you have a copy of pywallet?

you could follow casascius' instructions for finding the private keys in your wallet file just by using a simple hex editor:

http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm

doing that is almost certainly the slow way, because you'd be copying and pasting everything individually (and who knows how many keys are in your wallet), but at least you'd have the hex strings corresponding to your private keys.

open that program, load (a copy of) your wallet into it, and search for hex string 04 20. select the next 32 bytes after each one and choose clipboard->copy as hex string.

[RyNinDaCleM]

There is a reason why software devs go to school for programming. It isn't as simple as watching a yootoob vid and BAM, your writing code. I'm self taught C++ and I assure you, there is nothing *easy* about learning a first language.

[NINJA--]

I have the hex editor open and the wallet loaded. I may ask a few dumb questions along the way but if somebody can tell me what to do I CAN handle this.

[payb.tc]

I have the hex editor open and the wallet loaded. I may ask a few dumb questions along the way but if somebody can tell me what to do I CAN handle this.

have you searched/found the first occurrence of 04 20?

[NINJA--]

No I dont even know what that means. Looking at this text editor and all these rows of numbers and letters its starting to sink in that I might not be able to handle this.

[legolouman]

There is a reason why software devs go to school for programming. It isn't as simple as watching a yootoob vid and BAM, your writing code. I'm self taught C++ and I assure you, there is nothing *easy* about learning a first language.

I don't know, I started with python, and it wasn't so bad. I had a little help with my first project, and then it was learning whenever I needed to expand.

[trentzb]

If you figure it out on your own imagine how proud you would be to do so without asking for help. I encourage you to try before tossing in the towel. At the least you will have learned some things that may be useful in the future. If you fail to recover it yourself there are folks here willing to help for a fee.

"feed a man fish and he will eat for a night, teach him to fish and he will eat for a lifetime"...or something to that effect

Give it a shot, your incentive is likely greater than someone else doing it for you.

Hint: Search for the specific hex (CTRL-F maybe) Mike indicated and follow his other tips and see what you find

[payb.tc]

No I dont even know what that means. Looking at this text editor and all these rows of numbers and letters its starting to sink in that I might not be able to handle this.

firstly, choose Search->Count... from the main menu

choose "Hex String" and type 04 20 (the space should be inserted automatically, just type 0420).

make sure 'scope' is set to 'Begin'.

click OK

when i do that, i get a count of 684... meaning 684 possible private keys in my wallet.

extracting them manually (copy+paste) would take forever... like, more than a week (a very boring week).

actually, do you need these 600 btc at the moment? if you're a long-term holder it could be worth just starting a new wallet and keeping this 'bad' wallet in a safe place for a while in the hope that easier, user-friendly tools to fix it emerge later.

[NINJA--]

Message I get when I search 0420. Scope is set to begin.

[payb.tc]

Message I get when I search 0420. Scope is set to begin.

damn.

are you sure you were searching as a hex string, and not searching for '0420' as text?

[NINJA--]

The hex box is checked.

[payb.tc]

Positive the hex box is checked.

damn.

sorry i don't think i can help further.

[DeathAndTaxes]

Is your wallet encrypted?  Is so hex editor is useless.   You need to decrypt the wallet first (which may not be possible if it is corrupt).

[NINJA--]

Nope I never knew I could encrypt it.

[casascius]

I'm around if you would have me look. Not finding 0420 with a hex editor is a bad sign though.

[NINJA--]

How did you get VIP under your name? Did you put that there or was that earned from staff? Dont really matter but I am a little curious. Your the only one I see with it.

[Maged]

How did you get VIP under your name? Did you put that there or was that earned from staff? Dont really matter but I am a little curious. Your the only one I see with it.

He got it by donating 50 bitcoins to the forum.

As for this issue, have you tried pywallet?
https://bitcointalk.org/index.php?topic=34028.0
If you use it, only try it on a copy of your backup.

If you can access your old drive, try this:
https://bitcointalk.org/index.php?topic=25091.0

[casascius]

How did you get VIP under your name? Did you put that there or was that earned from staff? Dont really matter but I am a little curious. Your the only one I see with it.

I donated for it on the first day or two it came out, and it's because I wanted a spot to put my real name.

Look to others to vouch for whether I'd scam you.  If I recover anything, I don't even expect a fee.  Just rate me on #bitcoin-otc if you are able.

Also:

- if I were to scam you, others, given your wallet file, could determine that funds were recently taken.
- if your wallet were empty or worthless, others could confirm that, given the same file.

Yeah, I understand... sending your wallet to a complete stranger is a bad idea and is the last thing you want to do.  If nothing else, I'm a person whose real life identity is known and with an established reputation worth more than 600 BTC.  Your call of course.... but on the other hand, if you don't have 0420 anywhere in your file, chances are I might end up announcing you sent me a file full of null bytes, and will post a hash to the forum so you can confirm that with others...

(I suppose it's amusing I can use the number 0420 and hash in the same sentence, and be talking about computers, when normally it would sound like I'm talking about drugs)

[NINJA--]

Cool nice to know. Ive seen some people say white listed and I think Ive seen a few other titles. It did catch my eye so I figured I would ask. I also noticed staff vouching for you. Its just so hard to give you my wallet.dat. But to be honest it doesnt seem like I have many options. I did noticed that pywallet thread. I skimmed through it and book marked it but I haven't played with it yet. Is there anything worth trying before I send off my wallet?

[casascius]

Cool nice to know. Ive seen some people say white listed and I think Ive seen a few other titles. It did catch my eye so I figured I would ask. I also noticed staff vouching for you. Its just so hard to give you my wallet.dat. But to be honest it doesnt seem like I have many options. I did noticed that pywallet thread. I skimmed through it and book marked it but I haven't played with it yet. Is there anything worth trying before I send off my wallet?

If I determine your wallet.dat is junk, the only next thing worth trying would be to scan your entire disk using that utility I linked to.  But you installed an OS over top of it, so even then, your odds aren't that great.  You will at least know what to do next...

given your wallet.dat I will tell you one of two things:
"it's full of 0420's, you must have made a mistake and didn't find them, I recovered your BTC, what's your address"... I'll send you all your BTC, and then you can send the file to others to confirm I sent them all to you... (once the btc are sent to another wallet, the old wallet is of no value to anybody else)

or else

"this doesn't look like a valid wallet.dat, instead I see _______", and I'll invite you to send it to others to confirm that, because at that point you really have nothing to lose.

[NINJA--]

As much as I want to keep playing with it I know Im in over my head so Im gonna send it to you and hope for the best.

[casascius]

I haven't seen anything so far, and won't be at the computer for long.  mcaldwell at mc2cs.com.  Got some wine to pour soon.

EDIT: I'm offline.  Please don't send anything to my e-mail unless you PGP encrypt it first.

[trentzb]

If Mike finds nothing I'd be happy to take a glance and confirm what he found, or didn't find. Although I would suspect my findings would be identical.

[NINJA--]

How do I encrypt it?

[vuce]

http://www.gnupg.org/ (you will need to know casascius' public key in order to do this)

[payb.tc]

http://www.gnupg.org/ (you will need to know casascius' public key in order to do this)

casascius published his key in post #13: https://bitcointalk.org/index.php?topic=56023.msg667061#msg667061

as far as i know pgp and gpg are compatible... someone correct me if i'm wrong about that.

[vuce]

http://www.gnupg.org/ (you will need to know casascius' public key in order to do this)

casascius published his key in post #13: https://bitcointalk.org/index.php?topic=56023.msg667061#msg667061

as far as i know pgp and gpg are compatible... someone correct me if i'm wrong about that.

oops, missed that. Thanks for fixing it for me. (was searching his website, I was sure there had to be a pk somewhere

as far as i know pgp and gpg are compatible... someone correct me if i'm wrong about that.

They are, they both use the same standard (OpenPGP).

[NINJA--]

sent

[casascius]

 

I received a file... unfortunately, this is an empty file with no content.  Unless, of course, somebody else sent it to me as a joke (I have no way of knowing).

This file is 204,800 bytes long.  It is a file with 204,800 null bytes.  It contains absolutely nothing.

It has a sha256sum of 8eafc7bd411c1f02b9e972a83d2b0a4164eefc5ef51e6b63ad7acc78be4ad44f

You should compute the sha256sum of the file you have (linux: simply type sha256sum wallet.dat) to confirm we're talking about the same file.

The only other possible way to attempt recovery is to scan the disk.  This is a crapshoot if you've already installed a new operating system on it.  If you would like to attempt it, the first thing I would recommend is to stop using the disk immediately if you're using it now...

[casascius]

BTW is this the copy off your USB backup?  Didn't you say you had a physical hard drive failure?

If your hard drive has physically failed, For 600 BTC your drive might be worth sending to a recovery place that does this professionally.  Tell them you simply want all sectors containing a specific byte sequence (which I can give you, but also which I have detailed in another post).  If recovery is possible, this should be an EASY job for them, since they don't have to worry about trying to piece any of your files together.  They can either tell you, "yes we found those bytes" or "no we did not".

600 BTC seems to be approaching the $3000 mark... hard drive recovery typically costs much less than that, and if no recovery is possible, you're either out nothing, or one or two hundred bucks if you decide you want to let them try getting physically invasive with the drive.

[legolouman]

Before sending out the hard drive to a professional, put it in the freezer. Seriously, this is legit http://lifehacker.com/170257/macgyver-tip--save-your-hard-drive-in-the-freezer

[casascius]

Before sending out the hard drive to a professional, put it in the freezer. Seriously, this is legit http://lifehacker.com/170257/macgyver-tip--save-your-hard-drive-in-the-freezer

I would say best practice is to not run a drive that has experienced a physical failure.  So would any professional recovery outfit.  That's because if it's had a head crash, more motion equals more damage.

Any reputable one will give a FREE estimate and initial diagnosis, won't charge for non-recovery in most cases* and he clearly has what amounts to a $3000 budget to pay for any successful recovery, so why bother DIY'ing it any longer when doing so can only make things worse?

(*Most cases = They might call you and say, "OK, we got nothin, but we can try pulling parts from another drive and see if that works, and that's gonna cost you a couple hundred bucks regardless of the outcome."  If you say no, they don't charge.)  EDIT: Data can be recovered from MOST drives without needing this, especially so if you're just aiming for sectors, not full files.  Bitcoin recovery only needs sectors.

Tell the recovery company you want the drive searched for any sectors or files containing the following hex bytes: 01 03 6B 65 79 41 04, and all good sectors immediately surrounding any sector that contains this.

If they can find any sectors with those hex numbers and can dump all those sectors into a file (regardless of sequence - it's called a blob), that file can be used for bitcoin recovery.

And if you have any OTHER copies of this wallet.dat - new, old, USB, backup, whatever - don't hesitate to try those as well.

[legolouman]

Before sending out the hard drive to a professional, put it in the freezer. Seriously, this is legit http://lifehacker.com/170257/macgyver-tip--save-your-hard-drive-in-the-freezer

I would say best practice is to not run a drive that has experienced a physical failure.  So would any professional recovery outfit.  That's because if it's had a head crash, more motion equals more damage.

Any reputable one will give a FREE estimate and initial diagnosis, won't charge for non-recovery in most cases* and he clearly has what amounts to a $3000 budget to pay for any successful recovery, so why bother DIY'ing it any longer when doing so can only make things worse?

(*Most cases = They might call you and say, "OK, we got nothin, but we can try pulling parts from another drive and see if that works, and that's gonna cost you a couple hundred bucks regardless of the outcome."  If you say no, they don't charge.)  EDIT: Data can be recovered from MOST drives without needing this, especially so if you're just aiming for sectors, not full files.  Bitcoin recovery only needs sectors.

Tell the recovery company you want the drive searched for any sectors or files containing the following hex bytes: 01 03 6B 65 79 41 04, and all good sectors immediately surrounding any sector that contains this.

If they can find any sectors with those hex numbers and can dump all those sectors into a file (regardless of sequence - it's called a blob), that file can be used for bitcoin recovery.

And if you have any OTHER copies of this wallet.dat - new, old, USB, backup, whatever - don't hesitate to try those as well.

The freezer trick usually buys you about as much time on the drive as it spends in the freezer. Then it really dies forever. Drive recovery generally costs a ton of money, even more if they have to pull parts. While he might have a 3000 budget, I'm sure he doesn't want to spend 3k for the recovery, there would be no point. I understand what you are getting at casascius, I was just suggesting the easiest and most pain free way of doing this. A drive recovery would obviously be the way to go, but also the most counter intuitive, due the costs.

[casascius]

The freezer trick usually buys you about as much time on the drive as it spends in the freezer. Then it really dies forever. Drive recovery generally costs a ton of money, even more if they have to pull parts. While he might have a 3000 budget, I'm sure he doesn't want to spend 3k for the recovery, there would be no point. I understand what you are getting at casascius, I was just suggesting the easiest and most pain free way of doing this. A drive recovery would obviously be the way to go, but also the most counter intuitive, due the costs.

Have you ever outsourced a drive recovery?  I have.  It's far less than $3000.  Especially if the drive will spin up on its own and allows limited sector reads via diagnostic tools.

Only when you get into reconstructing RAID and servers does it get that high.  If recovery companies needed $3000 to recover family photos and excel spreadsheets, they wouldn't have much of a business, because most people will just say "aww screw it" before plunking that kind of cash down.

[jake262144]

Let's change our approach to the recovery a bit.

Ninja, have you had any success with your backup drive?
Does it spin up when powered up? Does it initialize? Is it at all visible to the OS or BIOS?
What exactly happened to that drive, did you drop it?
If the drive was indeed dropped, disregard my advice regarding software recovery - if the head got killed, it'll never pull any useful data off the platters.

Try connecting it to another machine (perhaps with a more patient disk controller).

If the BIOS sees it, there's a good chance you might be able to recover your data using data recovery software.
Spinrite might do the job, it's a very tenacious piece of software.
Be advised though, the recovery process has been known to stretch into weeks on some damaged drives, although for me it was never longer than a couple of days tops.
I'm in no way associated with the author, BTW, just a satisfied user.

[jake262144]

As to keeping backups, here's what I recommend:

(1) If you haven't already, download and install TrueCrypt. It's a great, free, and completely open-source piece of software with a great GUI.
(2) Encrypt your wallet file(s) into an encrypted archive ¹. Please use a VERY long passphrase. Make sure you don't forget the passphrase though ^^
(3) Propagate the encrypted archive. I send myself a copy as an e-mail attachment. I keep another copy on my smartphone. Yet another on my file server. There's a copy floating in the internet cloud... a myriad of options to choose from.

This way, whatever happens some copies will survive.
Should a third party obtain a copy of the encrypted archive, there's nothing they can do with it.

The last piece of advice is, never keep all your bitcoins in one wallet if you have a sizable amount of them.
Divide your bitcions into a number of wallet.dat files and encrypt them all.

Good luck with the recovery.



(1) A neat trick is not specifying any file extension for the encrypted archive. Mine exists as a file named something like b9e6c89a. There's nothing in the file structure which could identify it as a TrueCrypt archive, there's pure randomness inside. Have at it, you evil-doers

[NINJA--]

Nothing happened to the drive with my main backup. It just stopped working. I tried to restart my computer and it would not shut down. It was stuck in the shutting down process so I pressed the restart button. After that the computer never booted again it kept throwing up blue screens. I tried to restore and repair from windows disc but I couldnt even boot the disc without getting blue screens. I fucked with it for an hour before I decided windows was beyond repair and I loaded my backup image with acronis true image. After I loaded my backup I expected everything to be OK but I still could not boot in to windows. So I started pulling all the parts of my computer except for 1 stick or ram and 1 video card and I finally booted to my desktop. I started putting pieces back in one by one and as soon as I plugged in the secondary HD I got a blue screen. So at that point I knew it was the HD that was giving me problems. I have not played with the failed HD much. The bios does detect it but windows wont boot with it plugged in the sata port. When I plug it in an external USB enclosure it shows under disc management but I cant access the drive or give it a drive letter. I called western digital and they said they will attempt to recover my data for free.

[casascius]

...and I loaded my backup image with acronis true image. After I loaded my backup I expected everything to be OK but I still could not boot in to windows...

Is this backup image still intact?  Certainly it's got to have something better than a bunch of 0's for your wallet.dat.  Any way you could re-restore this somewhere else?  (into a folder on a working machine, not over top of a bootable OS)

[NINJA--]

Its funny that you should ask. The drive that failed is the drive that has the backup that I loaded acronis with. So even though the drive is failing I was still able to detect and load the image from it.

[casascius]

OK, the drive you reloaded your os BACK ON to (not the failing backup drive) is the one you need to sector-scan for private keys.  That's a drive that's not failing at the moment, right?

The private keys may still be recoverable from the unallocated space.

Got another drive you can work with?  The more you use this drive, the less likely it can be used to recover.

Does this drive have Windows on it?  You could use WinHex to attempt to search for the magic bytes.  (I would avoid installing anything onto the drive)

[NINJA--]

The drive with the OS is a SSD. I can yank it out and throw windows on another drive to avoid any further use.

[casascius]

The drive with the OS is a SSD. I can yank it out and throw windows on another drive to avoid any further use.

Do that.

Boot Linux though.  Get and run this utility on your SSD drive - directly on the device name (don't mount the drive, just point it at /dev/sdb or whatever) and let it just search the whole thing.  Should take a little while.

https://bitcointalk.org/index.php?topic=25091.0

If it gets anything, it'll build you a new wallet.dat.

There is a half decent chance it could find something, because wherever your wallet.dat used to be on disk, might not have been overwritten by your new OS install.  Your new OS install would start writing at the beginning of the drive, and your wallet might have been somewhere in the middle, well past the part that would be written during an OS install.

I think I know why your wallet.dat came to me as zeroes.  You probably restored a backup, which got as far as to write the part of your disk that says "a file named wallet.dat exists", but bombed out before it actually got to the part where the wallet data itself was restored.

[DeathAndTaxes]

The drive with the OS is a SSD. I can yank it out and throw windows on another drive to avoid any further use.

DO THIS IMMEDIATELY.  There is a chance you can recover everything but stop USING the drive.  Everytime you use it like a lottery there is a chance the sectors containing the wallet.dat will be overwritten and then it is gone for good.  Do the same for any drive which may contain (even corrupt or non functional) the wallet.dat, or image file. They should be used for "read only" until you recover the contents.

You said you have another drive.  If that drive has ever contained the wallet.dat OR the disk image which contained the wallet.dat DON'T USE THAT drive either. You want to preserve every drive which potentially could contain a copy of the corrupted data.  Multiple copies is better (because it is like having more lottery tickets ).  If that means buying a new cheapo drive then buy one.  You will want two "virgin" (never had a copy of wallet.dat or diskimage) drives.

If I am reading this correctly you made an image of your HDD?  That image contains the wallet.dat right?  If you can't recover the wallet.dat directly you may be able to recover the entire image file from the bad drive.    Don't try to restore the image yet.  Using a linux live CD (usb drive) you should be able to access the drive which contains the image, copy the entire image file to a new HDD.  Do it this way (instead of trying to have TrueImage access the drive to minimize disk access.  You are simply copying the entire image file from the bad disk to a good disk.  THEN AND ONLY THEN restore the image on the good disk to a third hard drive (which is why i said you want two "virgin" disks).




Lastly you may want to consider shipping the drive(s) to someone you trust.  With ~$3000 in potentially lost coins I am sure you can find someone trustworthy who would work for a finders fee.  If it were me and I couldn't recover it I would trust Cascius.  He has a rep and business which is worth more than your wallet and is knowledgeable.  You can try yourself first BUT FOR THE LOVE OF ALL THAT IS DIGITAL please do what I indicated above.  This will "preserve" the damaged disk and prevent your from ensuring nobody can ever recover it no matter how much money and effort it spent.

[terrytibbs]

MAKE AN IMAGE OF THE DRIVE AND NEVER WORK ON THE LIVE COPY

That is all.

[NINJA--]

I pulled the SSD. I have windows and ubuntu on separate drives. Im gonna try WINhex first since its a windows program. If that doesnt work I will try the recovery tool on ubuntu. Is there anything else I should do?

[mila]

I pulled the SSD. I have windows and ubuntu on separate drives. Im gonna try WINhex first since its a windows program. If that doesnt work I will try the recovery tool on ubuntu. Is there anything else I should do?

as terrybits recommended, make an image of the disk first and work on the copy
that way no matter what else goes wrong you damage the copy and can make another one.

[casascius]

I pulled the SSD. I have windows and ubuntu on separate drives. Im gonna try WINhex first since its a windows program. If that doesnt work I will try the recovery tool on ubuntu. Is there anything else I should do?

Are you around right now?  If you have WinHex on your computer, then join a GoToMeeting with me, share your screen, and I'll help you.  E-mail me and I'll give you an invite code

[NINJA--]

OK

[casascius]

Outcome: SUCCESSFUL RECOVERY.

Ninja accepted a GoToMeeting invitation from me, so I could remote-control his computer.  He had installed WinHex on it.

Ninja had most or all of his BTC on a single address he had used before (so the public key was available), so I was able to perform a search his drive for the public key rather than just wallets at large.  (His public key also appears in the block chain, so I had to skip numerous instances of that).

I searched his SSD drive and did not find anything wallet-like that contained his key.

I searched his USB stick, and found evidence of a wallet, but it did not contain this key.

Finally, I had him plug in his trashed backup drive.  Turns out the drive is readable, and apparently has trashed partition information but no physical problems.  It was sector searchable through WinHex.

His wallet backup from a week ago was intact.  I was able to extract the private key for the address he needed via WinHex, and turn it into a 51-character private key code using my Casascius Bitcoin Address Utility.  He redeemed the code on MtGox and recovered just over 670 BTC.

[NINJA--]

678 BTC to be exact. I was also able to recover everything else I had on the drive with winhex. That program is amazing. And so is mike. Awesome guy. He has VIP under his name for good reason. Thank you so much mike. You are the man.

[trentzb]

Nice job Mike!

[DeathAndTaxes]

Awesome work mike.


NINJA, any good ninja needs a backup plan. Make an encrypted backup of your wallet at least once a month and store it in multiple locations (other than the system where the original is used).   Google docs, email it to yourself, usb key in a safe, etc.

600+ BTC that's a nice recovery. 

[fred0]

+1 Karma

[NINJA--]

I thought 2 backups was enough. I was wrong. I now have all my stuff on 3 HD's, USB stick, and bluray disc.

[casascius]

I thought 2 backups was enough. I was wrong. I now have all my stuff on 3 HD's, USB stick, and bluray disc.

I agree - and one of those backups ultimately saved you.

For the benefit of others, I will repeat as a post:  I am convinced that the USB stick backup would have been good if the stick were properly ejected before removing it at the time the backup was made.  It appears as though it was yanked as soon as the computer acknowledged files having been "copied" to it, but OS's use "write-behind" caching to improve performance, actually pretending the write has completed, but writing the media later instead of making users and programs wait for the physical media to be done.  To see this in action, try copying a large file (100MB+) to a memory stick with an LED "activity" light, and look at how long the light continues to blink after the copying seems "done" according to the computer.

It appeared he had backed up the entire bitcoin folder - which will have included a large block chain, and the wallet being last (because it starts with w, which comes later alphabetically after blk0001.dat etc.)... by the time the computer said "done copying", it was probably still busy writing back the last of the block chain and, although it successfully wrote the wallet.dat entry into the root directory (so the OS knows a file "exists"), the actual file contents never got a chance to finish writing, hence a file that reads as being nothing but zero bytes.

The eject function always ensures that any write-behinds are completed before offering to let you pull the drive.  In fact, that is why there is an eject function in an operating system.  In any case, such as if the eject refuses to give up the drive (seems to happen a lot) you're probably safe after a minute or two to just pull the drive.

[mila]

For the benefit of others, I will repeat as a post:  I am convinced that the USB stick backup would have been good if the stick were properly ejected before removing it at the time the backup was made.  It appears as though it was yanked as soon as the computer acknowledged files having been "copied" to it, but OS's use "write-behind" caching to improve performance, actually pretending the write has completed, but writing the media later instead of making users and programs wait for the physical media to be done.  

suddenly life's not too short to remove usb safely
thanks for sharing. priceless lesson

[Gabi]

Put an encrypted wallet on the internet (like msn skydrive, send it as mail attached file to other addresses etc)

So you can ALWAYS recover them

Note: with encrypted wallet i mean a wallet encrypted in a good way with a good password.