Formatted Drive , Lost wallet.dat

[Robert23]

Where are you located ? What SSD was it ?

I'm located in the Bay Area. It's a 40gb Intel X25-V

[chromeguy]

SSD make chance of recovery even worse as they have garbage collection.   I wouldn't even boot up until you are ready to attempt recovery.  SSD are slow to erase and must erase before they write so in the backup the SSD controller will erase blocks marked as unused.    Unlike a magnetic HDD where the file remains until it is overwritten w/ an SSD you can lose the data simply by letting SSD sit idle even if the file isn't overwritten.

that's nasty!

can you make a clone image using a program designed to image corrupt hdd's? this way you can poke and probe without fear of this garbage collection performing.

also, y u no old backup?!
just discussing on a different thread about the wallet, an old backup will restore up to 100 post-backup keys/transactions from the backup date.

what program do you suggest?

i have never done it before, only had to do a couple of data recoveries from disk hdd's & they were in decent enough shape i wasn't afraid of it suddenly grinding to a halt.

perhaps norton ghost? i am not sure.

[bulanula]

Where are you located ? What SSD was it ?

I'm located in the Bay Area. It's a 40gb Intel X25-V

I will do it for 15 BTC if successful. Can you ship to the UK ?

[Robert23]

I was hoping I could do something on my own to solve it. Will the hex editor method work on a SSD?

[casascius]

Yes it will work, though it just may not find anything.

If a hex editor can't find your wallet, I can't either.

[Robert23]

Yes it will work, though it just may not find anything.

If a hex editor can't find your wallet, I can't either.

How about the wallet.dat on the Flash drive? The only diffrence between that and the one on the ssd is 1 transaction and I put a password on it. Thanks for your help.

[casascius]

An old wallet has a VERY GOOD chance of being usable to recover bitcoins, even if they were received after the backup was made.

Make an extra copy of the wallet for safekeeping.  Then, shut down Bitcoin, put a copy of the flash drive wallet in place of the empty wallet.dat that was created by Bitcoin, and then restart Bitcoin with the "-rescan" command line switch.  This takes several minutes.  If any coins are recoverable and your block chain is up to date, they will show up in your balance.

[Robert23]

An old wallet has a VERY GOOD chance of being usable to recover bitcoins, even if they were received after the backup was made.

Make an extra copy of the wallet for safekeeping.  Then, shut down Bitcoin, put a copy of the flash drive wallet in place of the empty wallet.dat that was created by Bitcoin, and then restart Bitcoin with the "-rescan" command line switch.  This takes several minutes.  If any coins are recoverable and your block chain is up to date, they will show up in your balance.

Sorry I left out important information. I deleted the wallet.dat file on the flashdrive because I was going to move the updated wallet.dat onto it, which I forgot to do. I'm asking if the deleted wallet.dat on the flash drive is recoverable.

[BurtW]

Since you did not reformat it, and assuming you have not written to it then it should be easier to recover than from the formatted drive.

[casascius]

Sorry I left out important information. I deleted the wallet.dat file on the flashdrive because I was going to move the updated wallet.dat onto it, which I forgot to do. I'm asking if the deleted wallet.dat on the flash drive is recoverable.

Very possibly, yes.

Install WinHex on your machine.  Insert the flash drive.  Run WinHex as administrator by rightclicking its icon and selecting Run As Administrator.  In WinHex, press F9 to see a list of physical drives, choose the flash drive.  (It appears twice, once as a drive letter and once as a physical device.  Choose the physical device - the bottom one.  If you did not run WinHex as administrator, flash drive will not appear in the physical media list.)

Perform a hex search on the entire drive.  Search for the following hex: 01036B657941.  It should take several minutes.  If you find a search result from these bytes, recovery from the drive is likely possible.  Do it, and let us know how it worked.  The recovery itself may be more complex, but at least you'll know it's there.

In the meantime, DO NOT SAVE OR WRITE any files to the flash drive.

[Robert23]

I found that series on my drive. What next? Thanks again for all the help

[casascius]

I found that series on my drive. What next? Thanks again for all the help

I offer to do a GoToMeeting recovery for 10 BTC.  (GoToMeeting is a commercial web conferencing platform I subscribe to.  I would invite you to a web meeting, make you the "presenter", and you offer control of mouse and keyboard.)

Meanwhile, here are the steps I intend to do (you're welcome to attempt DIY if you want by all means):

1. Repeat your search
2. Form an opinion as to which sectors belong to your wallet by scrolling through sectors on your flash drive (this is the subjective part)
3. Export those sectors to a file.
4. Have you open your e-mail so I can e-mail myself the file.
5. Use a utility on my side that breaks the private keys out of the file (I wrote it, it's a custom script).  The way this script works is described in a thread linked to previously in this thread.
6. Import them into a wallet and do a rescan (this takes 10 minutes)
7. Send you the BTC to the address of your choice

[casascius]

Outcome: SUCCESSFUL RECOVERY.

Robert accepted a GoToMeeting invitation from me.  We had trouble with GoToMeeting, it would only let me see his screen, not control his computer.  Regardless, I just gave him instructions of what to click through the chat window.  I suppose it slowed us down some, but it still didn't take too long.

We repeated the hex search he said was successful on his 8GB USB flash drive.

I had him copy a group of sectors that appeared to contain wallet data.  He copied and pasted it to a file and e-mailed it to me.

We searched the remainder of the drive for additional wallet fragments and found none.

I used my script that digs through the raw data, looking for "0420" which marks private keys.  It grabs all of the keys (typically there will be over 100), and auto-generates a script that allows the creation of a brand new wallet.

After rescan, his full balance was recoverable.  I sent it to a brand new bitcoin address.

Successful recoveries are always better than having to tell people they are SOL, especially if it's a lot of money.

[BurtW]

That is great!  I guess you now have another new side business

[DeathAndTaxes]

That is great!  I guess you now have another new side business

Yeah he is 2 for 2 now right and both were good sized wallets.

[marked]

Out of curiosity why isn't there a mechanism to write two wallet.dats atomically (both have to succeed), one to the [%APPDATA%|$user]\bitcoin directory, and another to a usb key or alternate drive?

or even to -dumpwallet after each transaction on the client?

marked

[Gavin Andresen]

Out of curiosity why isn't there a mechanism to write two wallet.dats atomically (both have to succeed), one to the [%APPDATA%|$user]\bitcoin directory, and another to a usb key or alternate drive?

or even to -dumpwallet after each transaction on the client?

Because we don't have infinite programming resources, and we've been busy working on low-level stuff that will lead to solutions that will fix the "my hard drive crashed" and also the "my computer got infected by malware" and "my house burned down along with my computer and all of my USB thumbdrives" disaster scenarios.

[Wekkel]

Out of curiosity why isn't there a mechanism to write two wallet.dats atomically (both have to succeed), one to the [%APPDATA%|$user]\bitcoin directory, and another to a usb key or alternate drive?

or even to -dumpwallet after each transaction on the client?

What's the problem with making the backup yourselves?
It's the same as loosing your Outlook inbox or, worse, your personal documents and pictures.

Backups are essential.

[BurtW]

How much money is involved?  You can always contact casascius and he can help you for a fee.  He is very good at it and worth every bit cent!