REWARD. Help with Multibit 0.4.23 Mac, Deleted wallet

[msherwood]

So, my roommate just totally f*d up yesterday. He is using multi bit 0.4.23 on a june 2012 15" stock MBP os10.8.2. He had a wallet with 200 bitcoins. He sent 50 to a new wallet, and without thinking immediately deleted the change wallet, essentially losing 150. He shut the computer down, flipped out, and was sedated. I'm helping him, and have spent last night and today searching mostly this forum for answers. I target disk his machine, then created a disk image from his HD. I ran Boomerang data recovery on the image using a user created signature from .wallet and .info files in library/application support/multibit directory. I have 23 .info files recovered, ~13MB. I'm not an expert on bitcoin, and am not sure what to do next to restore his .wallet. I found some info here https://bitcointalk.org/index.php?topic=25091.0 regarding recovering .wallet files in linux, and am not sure how portable these utilities are to mac os. If you are able to help, i'm sure my roommate will make it worth your while and send some BTC your way... I have some questions i'm not 100% on yet.

1. Does Multibit secure delete wallets, and if so is this the territory of forensic data recovery only?

2. Is all i need to find to restore the wallet the private key, and if so where would multibit keep that? It is a 51 digit number that begins with a "5," would this exist in any log or .info file?

3. How many days should i keep my buddy sedated before worrying about benzo withdrawals? ...joking

Thanks in advance to everyone. Anyone who wants to admonish my roommate feel free, though once he comes to he will be admonishing himself plenty.
-mathew

[pheaonix]

1. likely no.
2. yes. with this and some googling you will be fine.
3. my expertise is actually in neurology. it depends on his weight, but assuming a xanax bar per 8 hours, he will start to be susceptible to decent withdrawals within 3-5 days.

if you need further assistance i will be happy to help, i wish you good luck recovering that fortune.

[lbr]

Whatever you do, don't write any data on the HDD from wich you will be recovering from.
You need to plug it in the different computer and do recovery there, recovering files to different HDD.

[lbr]

Oh, and I use R-Studio for Mac recovery for my clients, works like a charm.

[msherwood]

the console log shows a secure delete from multibit at the timestamp of his screw-up... i'm finding conflicting info about recoverability of secure deleted files. I'm now working with an image of the target HD, and am not using the actual HD to run scans. Hoping to try a better user defined signature in Boomerang to scan for multibit.wallet file and run another pass. I cant seem to find any objective comparisons for data recovery solutions, and already had boomerang. Some don't allow a user-defined file type, an a few require hexadecimal header info i'm not sure of to scan for .wallet files... so unless there is a really good reason to i'm going to stick with boomerang for now to comb through the image of the target drive. Does anyone know about DiskWarrior? It has the most robust scavenge feature for lost data i've seen, but is more useful to repair corrupted directory data. I may give it a try to scavenge for my buddy's "multibit.wallet" file. Its saved me on some crashed drives in the past to recover everything. Thanks again.

[msherwood]

Still haven't gotten anywhere, anyone have any ideas? Obviously this HD with 150 lost bitcoins has gone up in value since my original post.

[pompiedom]

Might be a stupid suggestion (but who knows ), but was local backups/local snapshots (http://support.apple.com/kb/PH11394) on?

[cr1776]

I presume he didn't have time machine backups on?

The rest of the advice has been good so far.

[Mitchell]

Locked to prevent further necro's.