LOST SEED AND WALLET (RECOVER)

[Evolution]

Ok, so i generated an Electrum wallet through Tails inside a VMware and i was very dumb by only copying the Seed to a TXT file on my Main computer. Everything is alright until now but then, this TXT file just disappeared. Don't ask me how, i don't know, maybe i was so dumb i placed that TXT file inside a folder that got substituted, this is an option.

Also i tried using windows search, Windows Grep, Notepad C++ but since i only know a few words that were inside the file and these words are very common, i get a load of results. (still i searched alot of them)

I tried using Recuva, R-studio and almost all programs i could find but all i could find was some .LNK files of the original .TXT file.

When i open these .LNK files they tell me the original TXT is no longer on the original folder (nice..).

Do you guys still think i can recover the wallet.dat even through it was created by Tails inside a VMware?

Or better, recover the lost seed that was inside an TXT file that just disappeared.

I know the file name, i know the approximate date it was created, i know some adresses of the wallet but i don't know a single word of the seeds.

Although i know it was 2 seeds in the same .TXT and it had something written inside like

Elec 1

--There goes the 12 words of the seed--

Elec 2

--More 12 words--

Above all the effort i've done, do you professional tech guys know another way i can find this? I'm willing to pay and we're talking about 2K $ worth in this wallet.

Any help will be much, much, MUCH appreciated.

Thanks in advance.

PS: How the hell this file just disappeared like that when i can recover files from almost 4 years ago. Even if it was overwritten, i could still find some trace of this file, but all i seem to find is shortcuts (.LNK) of him.

[1715672969]

1715672969

[1715672969]

1715672969

[1715672969]

1715672969

[1715672969]

1715672969

[1715672969]

1715672969

[Abdussamad]

You should shut down your computer immediately because the more you use it the lower the chances that any data can be recovered. Then you can remove the hard drive and send it off to a data recovery operation. It'll cost you a lot, though.

[RoxxR]

- I know it shouldn't be there, but did you look in the recycle bin?

- Also, try restoring your system to an earlier date (a few days later than the file creation date, since you know it) using System Restore.

- Did you create the text file using Notepad, MS Word, or something else? Depending on the application, a backup of the file might have been saved under a different name as well.

- I can point you to a command that lets you search your drives for all recently created ASCII files containing exactly 12-word sequences, if you're interested in that. There shouldn't be that many files matching that specification. EDIT: see my post below.

[jonald_fyookball]

if the file somehow moved, it should still be the same file name, right?
If you looked for that filename on the whole system, and its not there...then it might be gone  


edit: good point rox about the backup name...OP, please do a wild card search *yourfile* with windows grep.

[RoxxR]

Also a lot of search tools on Windows are NOT comprehensive. I would highly suggest that you try the portable version of the aptly named Everything search tool. You'll be amazed, I swear by it.

Official homepage: http://www.voidtools.com/

It's a tiny download. Once you have it running, just look for the following search string:
*.txt dc:last40days size:<800

[RoxxR]

If you don't want to download any new software, and assuming you have a fairly modern version of Windows, you can try the following Powershell command. Open an elevated CMD window and paste the following:

Code:

powershell -ExecutionPolicy RemoteSigned -command " $ErrorActionPreference= 'silentlycontinue' ; gci c:\*.txt -force -recurse | where { $_.creationtime -ge '5/23/2014' -and $_.length -le 999 } | sls -pattern '( [a-zA-Z]+){10,20}$' | group path | select name "

This will list all seed file candidates, anywhere on your C drive.
FYI, on my system, it doesn't take more than 4-5 minutes and the resulting list is fairly targeted.

EDIT: I just updated the command so it also greps the files in the recycle bin (which many tools don't).

[zahra4571]

Unfortunately you cant recover it from tails because when you turn it off it deletes all data you made in it.
Search the participation maybe is accidentally moved to another folder, or try to search at more specific folder where the file is deleted it help program to recover easier.

[Evolution]

Hello, first of all i'd like to say many thanks to all the users replying and trying to help. I won't forget you if i suceed recovering.

- Did you create the text file using Notepad, MS Word, or something else? Depending on the application, a backup of the file might have been saved under a different name as well.

Unfortunately, the date i approximately created the .txt was around 16/July and it was created on the most basic notepad from windows 7. ( I know most more sofisticated programs like MS notepad and Word can recover my texts but it was not the case. I used the simple notepad.)

- Also, try restoring your system to an earlier date (a few days later than the file creation date, since you know it) using System Restore.

I've readed that windows restore does not restore personal files, only changes in the system. Also i do not have a restore point that was near the date i created the .TXT.

Since the file just disappeared, i can only assume 2 things :

1. I substituted the entire folder that the .TXT was inside.
2. It got moved and is somewhere in my drive. (I used the search but i can only find .LNK files related to my missing .TXT but since it's not it's original folder, the .LNK doesn't work.)

I also restored ALOT of .TXTs using R-Studio (a professional program to recover deleted files) and it was like 16 GB worth of TXT but they are named from 1 to 9999999. In these TXTs, i could find old Skype messages and alot of junk i didn't even knew was on my drive, this also gives me hope on finding something that important that was deleted not that long ago comparing with other 1 year old files i found.

To finalize, i'll try that method you told me RoxxR and i'll come up with an update. I'm pretty optmistic.

I'll try all methods.

Thank you very very much in advance and i won't forget your efforts my dear friends.

Yours, Evolution.

[ForgottenPassword]

Just so you know, if the file has been deleted you should NOT be using the computer. Every time you use it you risk overwriting the deleted file making it unrecoverable. You really should be doing the recovery process from another PC and have the hard drive connected as a slave and mounted read only.

[Evolution]

My dear friends, i'm pretty sure my file got overwritten or something like that.

BUT, i did a huge recovery of 16 GB worth of .TXT earlier in july. The problem is the Metadata is all erased, no name, no date, nothing. They're all named from 1 to 9999999.

I can bet the file we're looking for is between those millions of TXT as i could find some personal data inside some of these files.

All i ask you all and specially you RoxxR is a command line so i can search inside those millions of TXTs the strings we're looking for.

I can tell you approx created date it was around 12/07 and 16/07 (maybe this metadata got erased so let's forget creation date) The file name was Electrum.txt (worthless) and the file looks like this inside.

Elec 1

HERE GOES THE 12 WORDS


Elec 2

HERE GOES MORE 12 WORDS

-----------------------------

Does you know a search parameter that searchs for "Elec 1" or "Elec 2" matching whole word in those files?

If the file is there, we'll find it !

Your effort won't be forgot, thank you alot in advance.


PS: RoxxR "Everything" is pretty good, i just need an command because i'm pretty newbie to these strings.

PS 2: Powershell command gave me an error message.

[RoxxR]

Hi,

Does it help if you search Everything with: "*.txt dc:last60days size:<800"  (without the double quotes)?
Or does it still return too many results?

If so, I believe your best bet is the Powershell method. as Everything does not support content searching, unfortunately. What error are you getting with Powershell? If it's related to the execution policy, I've just edited the command so it enforces the policy itself.

By the way be sure to copy and paste the full command line from my post, rather than manually type it, as the syntax is quite tricky (single and double quotes, space characters matter, etc)


To search for "Elec 1" or "Elec 2" matching whole word, another good Powershell command is this one:

Code:

powershell -ExecutionPolicy RemoteSigned -command " $ErrorActionPreference= 'silentlycontinue' ; gci c:\*.txt -force -recurse | where { $_.creationtime -ge '5/23/2014' -and $_.length -le 999 } | sls -pattern 'elec [12]' "

[fuckthesystem]

Originally posted as a private message, reposting here for future reference:

I have to ask you, is it possible that you moved the file to, e.g. a flash drive, a CD, a ZIP or other archive inside the same disk, or encrypted it or printed it or anything like that? Is it possible that you saved the electrum wallet file after all (by the way, the default name for Electrum wallet files is "default_wallet", not "wallet.dat")?

Did you try the Previous Versions feature in Windows 7: http://www.sevenforums.com/tutorials/85679-previous-versions-restore-files-folders.html ?

Are you sure the .lnk file you recovered is a valid .lnk file (when you right click on it and then "Properties" it should display the path where the original .txt file was)? Could it perhaps actually be the .txt file with a wrong extension (you can try to drag the .lnk file and drop it over Notepad and it will open its contents)?

I see that you have R-Studio, so I will suggest one good way to quickly search the entire disk for the contents of your .txt file using that program. This way it searches both deleted files and existing files (you can use that to also search the 16GB of recovered .txt files). Open R-Studio and right click on your disk or partition (e.g. C:) and then click "View/Edit...". Click "Find" and enter a pattern in the "ANSI" field. Ask yourself are you sure that you have exactly "Elec 2" in your text file and not e.g. "elec 2" or "Elec 2:" or "Elec2". When you decide what pattern to look for it would be better to make the pattern as long and unique as possible, so that you get fewer false positives. Try to also remember if you are sure that "Elec 2" is exactly at the beginning of the line and if you pressed enter immediately after it. So if the right pattern is exactly "Elec 2", preceded by a new line and followed by a new line, you can add the newline characters using the HEX field. Newline in text files created in Windows has the HEX code 0d 0a. So the whole pattern to enter in the HEX field (for the pattern: *newline*Elec 2*newline*) is this:
0d 0a 45 6c 65 63 20 32 0d 0a
Be careful when you've edited both "ANSI" and "HEX" fields, because it has bugs and it changes the HEX codes of newline sometimes. Make sure that it says "0d 0a" where it is supposed to before you start the search.
Then check "Match Case" if you want to search for the pattern with capital and small letters exactly as you've entered them.

I don't use Windows 7, so I don't know whether the Notepad you used might have saved the file in Unicode format. You can open Notepad now and click File->Save as... and see at the bottom of the window - does it say "Encoding: ANSI" or does it say "Encoding: Unicode" or something else? If it says Unicode, then your file might have been saved as Unicode and then you should enter the pattern in the "UNICODE" field in R-Studio instead.

This search has one limitation - it will not be able to find text that is in files that are compressed or encrypted (including NTFS' compression and encryption - for example, files from restore points are usually compressed).

Please tell me what happens and ask me if you need help with any of this. Good luck.

P.S.: Could you by any chance still have a saved session in VMware from the same boot of Tails as when you created the wallets?

Also, have you ever exported and saved a private key from any of those Electrum wallets (it can be used in combination with the master public key to find the seed)?

[sdp]

Try a search with files containing 'seed'.

[DaveF]

for /f  %F in ('findstr /m text_to_look_for  filename.extension') do notepad.exe "%F"
Wildcards can be used in filename.extension.
You have to run it in the folder with the files.

So:
for /f  %F in ('findstr /m dave  *.txt') do notepad.exe "%F"

would search all the files with the txt extension for dave in them and then run notepad to open the files.

IF THERE ARE LARGE AMOUNTS OF FILES IN THE FOLDER, GRAB YOURSELF A BEER IT COULD TAKE A WHILE.

-Dave