Recovering address and key from corrupted wallet

[monstery]

Hi,

I need help recovering bitcoin from my wallet. I have damaged my partition filesystem and i am not able to recover wallet.dat.
I did make image of my disk and i am able to locate at least parts of my wallet.dat i hex editor.
In hexeditor I see strings like: key, pool, addr ...

Lost bitcoin were on this address:
http://blockexplorer.com/address/19ypz7Hx8RYdf87iwajU5KdKGvps8RMM8q

A I understand i need to extract keys for this address and import them to my new wallet. Can someone help?

[1715146939]

1715146939

[1715146939]

1715146939

[1715146939]

1715146939

[m4rkiz]

what exactly happened? now many transactions did you had?

try searching for that as all wallets have this header common

[monstery]

I was reinstalling windows as installer overwritten some of my truecrypted partition.

I had something around 20 transactions in wallet, but the i am sure that most bitcoins are at the address i posted.

I found wallet header, but i cannot restore it, because i dont know where it ends. Even if i knew where it ends it is probably fragmented anyway.

[m4rkiz]

yes, encrypted partitions can be pain in the ass some times, i had few of those problems myself back when i started to use full disk encryption

im afraid that i don't know anything about wallet structure so i can't help you there

btw. it would be nice to see some marker at the end of wallet file

[mewantsbitcoins]

I was reinstalling windows as installer overwritten some of my truecrypted partition.

I had something around 20 transactions in wallet, but the i am sure that most bitcoins are at the address i posted.

I found wallet header, but i cannot restore it, because i dont know where it ends. Even if i knew where it ends it is probably fragmented anyway.

monstery I,m not sure this will work, but here's an idea. Try restoring the encrypted volume header from the disk that truecrypt created when you created the volume and try mounting it.

[monstery]

monstery I,m not sure this will work, but here's an idea. Try restoring the encrypted volume header from the disk that truecrypt created when you created the volume and try mounting it.

I did that already. Thats how i've been able to get unencrypted image of my disk.

I looked to the source code, but with my basic C++ skills i can't figure out how are the keys stored. I think key is 265bit int? But which key is used with which account?

I really think wallet should be in some text format like JSON or XML. It would be so much easier to recover.

[Pieter Wuille]

The keys are stored using the standard OpenSSL encoding for ECDSA private keys, which actually includes a copy of the field parameters, curve parameters and the public key as well. 279 bytes per key, in total. A lot of these bytes are constant (as they are fixed for secp256k1), so you could look for those, and recover the 279 bytes around it, and use the bdb library to recreate a wallet.dat file with those keys in it.

PS: I'm working on a wallet export/import to human-readable files, but it may still take a while.

[monstery]

I assembled my old wallet from parts and it works.

Many thanks for all of you. Especially for sipa.

[niooron]

I hope you have that wallet backed up on 10 different online and offline backups now.