Formatted Drive , Lost wallet.dat

[Robert23]

HI everyone,
This evening I did a clean reinstall of windows, however I forgot to move my wallet.dat. When I realized my mistake, I booted into a live cd of ubuntu. I tried to recover the keys using this https://bitcointalk.org/index.php?topic=25091.0, but it said the command was not found. Can anybody help me out.
Much thanks

[devoblackflag]

Honestly you're probably fucked. Which command wasn't working?

[casascius]

Does that mean it searched your drive and found nothing?  Or that you couldn't get the command to start?  How long did the command "think" before it decided it didn't work, and how big is the drive?

I just successfully recovered someone's BTC just a few days ago... we did it by installing windows on a different boot drive, and then I got on GoToMeeting and dug up his BTC with a hex editor.

[jake262144]

LEARN TO BACKUP VALUABLE DATA :<

but it said the command was not found.

Which command wasn't found?
There are a couple steps to the whole procedure and you haven't told us which one failed.

[casascius]

Well... Just don't write anything to that drive until you have either recovered your BTC or determined it's a lost cause.  Don't boot it, don't install anything to it, don't save anything to it.

Was it a decent amount worth major effort to save?

A hex editor can determine very quickly if there is a recoverable wallet on the drive.  The wallet will be completely recoverable if it is on sectors that have not been overwritten.

[Robert23]

Yeah, it's a 125 bitcoins. I forgot to add that it's an ssd too, and also that I had a 2 month old copy of wallet.dat on my flash drive, before I deleted it since I was going to move the new wallet.dat onto it. The command ./wallet-recover-0.2-linux/bin/32/wallet-recover did not work.

[chromeguy]

i have done many clean reinstalls of my Windows, and it simply renames the old copy to windows.old - unless you meant you did a format?
if format, use a file recovery program such as piriform's Recuva - as mentioned before, do not boot or write ANYTHING to the drive.

[DeathAndTaxes]

This highlights why all wallets need to be deterministic.  As user base grows you will get less and less tech savy users.  A strongly encrypted, lose it and you are fucked wallet is fine for power users, businesses, custom development but not for Joe Sixpack.

[BurtW]

The command ./wallet-recover-0.2-linux/bin/32/wallet-recover did not work.

Still not sure if you mean a) you tried to run this command and the program did not run or b) the program did run but after scanning your entire drive it did not find anything.

Which is it?

Since it is over $600 (at this time) you might be able to ship your drive to someone who knows how to do this and pay them a finders fee if they can find it (?)

[BUTAB]

did you delete the partition?

[Robert23]

Yes, I unfortunately reformatted the drive.
I loaded up a ubuntu live cd, opened the terminal and entered
"wget http://www.makomk.com/~aidan/wallet-recover-0.2-linux.tar.gz
tar xzf wallet-recover-0.2-linux.tar.gz"
then I entered this

sudo ./wallet-recover-0.2-linux/bin/32/wallet-recover /dev/sda recovered-wallet.dat
however the terminal said that this command "
/wallet-recover-0.2-linux/bin/32/wallet-recover"
was not found.As for shiping my drive, is their anyone who can fix it for me like that and for what fee.
Thanks for the replies

[bulanula]

Yes, I unfortunately reformatted the drive.
I loaded up a ubuntu live cd, opened the terminal and entered
"wget http://www.makomk.com/~aidan/wallet-recover-0.2-linux.tar.gz
tar xzf wallet-recover-0.2-linux.tar.gz"
then I entered this

sudo ./wallet-recover-0.2-linux/bin/32/wallet-recover /dev/sda recovered-wallet.dat
however the terminal said that this command "
/wallet-recover-0.2-linux/bin/32/wallet-recover"
was not found.As for shiping my drive, is their anyone who can fix it for me like that and for what fee.
Thanks for the replies

Where are you located ? What SSD was it ?

[chromeguy]

Yes, I unfortunately reformatted the drive.
I loaded up a ubuntu live cd, opened the terminal and entered
"wget http://www.makomk.com/~aidan/wallet-recover-0.2-linux.tar.gz
tar xzf wallet-recover-0.2-linux.tar.gz"
then I entered this

sudo ./wallet-recover-0.2-linux/bin/32/wallet-recover /dev/sda recovered-wallet.dat
however the terminal said that this command "
/wallet-recover-0.2-linux/bin/32/wallet-recover"
was not found.As for shiping my drive, is their anyone who can fix it for me like that and for what fee.
Thanks for the replies

this sounds to me (with virtually no linux experience) like the actual wallet-get program isn't installed to your live cd (ram drive, whatever) properly or you are trying to access the wrong path.


edit: i'm pretty sure that you can get UBCD4WIN that has recova or similar program on it - even linux live-cd's should have some kind of recover-file-after-format utility on them, try an inbuilt one & ask it to search specifically for wallet.dat

[casascius]

If all else fails, I can do it for 20 BTC, payable only if successful, plus the cost of return shipping for your drive regardless of success assuming you want it back.  If your wallet was encrypted, I will need the encryption password you used.

Here was my last successful recovery. https://bitcointalk.org/index.php?topic=56023.msg672983#msg672983

My mailing address is on my website in my sig line.

Your chances of recovery are maximized if you do not boot the drive and do not write anything to it.  Feel free to boot other drives and play with your drive as a secondary drive, but don't let it start as primary.

[DeathAndTaxes]

Your chances of recovery are maximized if you do not boot the drive and do not write anything to it.  Feel free to boot other drives and play with your drive as a secondary drive, but don't let it start as primary.

THIS.

If you don't follow this instruction you can kiss any chance of recovery goodbye.

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

[chromeguy]

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

that's nasty!

can you make a clone image using a program designed to image corrupt hdd's? this way you can poke and probe without fear of this garbage collection performing.

also, y u no old backup?!
just discussing on a different thread about the wallet, an old backup will restore up to 100 post-backup keys/transactions from the backup date.

[DeathAndTaxes]

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

that's nasty!

can you make a clone image using a program designed to image corrupt hdd's? this way you can poke and probe without fear of this garbage collection performing.

That might actually be a very good idea to do before anything else. 

[casascius]

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

that's nasty!

can you make a clone image using a program designed to image corrupt hdd's? this way you can poke and probe without fear of this garbage collection performing.

That might actually be a very good idea to do before anything else.  

I suppose whether or not an SSD will garbage-collect abandoned data after a format would be highly dependent on whether the formatting OS issued a TRIM command to the drive to explicitly signal that the data is no longer needed, specifically TRIMming the entire drive as a whole.  I am not entirely sure whether or not that happens during a disk format operation.  But such idle garbage collection is only a concern if the answer to that question is yes.

EDIT: I just googled and found this: http://digfor.blogspot.com/2011/08/ssd-trim-encryption-formating-and.html - which, if correct, would be bad news.

[DeathAndTaxes]

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

that's nasty!

can you make a clone image using a program designed to image corrupt hdd's? this way you can poke and probe without fear of this garbage collection performing.

That might actually be a very good idea to do before anything else. 

I suppose whether or not an SSD will garbage-collect abandoned data after a format would be highly dependent on whether the formatting OS issued a TRIM command to the drive to explicitly signal that the data is no longer needed, specifically TRIMming the entire drive as a whole.  I am not entirely sure whether or not that happens during a disk format operation.  But such idle garbage collection is only a concern if the answer to that question is yes.

I don't know about other OS but I do know Windows 7 specifically (both install DVD and OS internally) fire TRIM on a format for all blocks in the format.  Ironically this was considered a good thing when it was announced (because otherwise a format won't solve various performance problems).

[Robert23]

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

that's nasty!

can you make a clone image using a program designed to image corrupt hdd's? this way you can poke and probe without fear of this garbage collection performing.

also, y u no old backup?!
just discussing on a different thread about the wallet, an old backup will restore up to 100 post-backup keys/transactions from the backup date.

what program do you suggest?