0.5 BTC Bounty to whoever helps me recover my BTC

[mpalenciac]

I'm having a gigantic issue with BTC wallet, it's a long story but I'll try to explain myself in the best way possible,  basically my 1.6 btc from my wallet are gone.

I used to do my entire work from my laptop and it died out on me a few days ago on the 16th actually.
This is my wallet address https://blockchain.info/address/15fqQ7a8fpugjfcQL4hj734FLvVjV8zgua
I was able to copy the wallet.dat by taking it out of the laptop's drive and copying it into my server for a few days, I made some transactions from there, actually all transactions from the 17th onward were made from the server.
I deleted the server's bitcoin folder once I did the transactions I needed but kept the wallet.dat from the laptop in a USB key.
I copied this wallet.dat to the new computer, synced and the BTC weren't there.
These are the transactions that took place from the server and generated new addresses with the "change".

I sent 0.8 BTC on this TX, it created 1.32 btc as change in a new address:
3641d7ffcfa0fd9aba036a46d753730691ae008b9cbac3e7bd3feb37885407ca

I sent 0.01 BTC on this TX, it created 0.365 as change in a new address:
bc12327475b3c71a134f18076cf13453bba4bfaaba080ab5ba1d348fcb9e0a6f

when I synced using the backup today, all my wallet's showing is 0.09 btc.
The addresses generated by the "change" can't be seen from my wallet, I can't get their privkeys or anything. I only have the privkey from the address that received the funds originally which is 15fqQ7a8fpugjfcQL4hj734FLvVjV8zgua

Any help would be greatly appreciated, I've got a 0.5 BTC bounty for whoever helps me out fix this and get my funds back.

Thank you



EDIT: I forgot to mention that I'm using bitcoin-qt on linux and the Transactions were made from bitcoind on a server.

[1714788928]

1714788928

[1714788928]

1714788928

[1714788928]

1714788928

[1714788928]

1714788928

[MRKLYE]

http://www.linuxlinks.com/article/20100226123335414/TestDisk.html

Use test disk to recover your old wallet files / privkeys.

I hope this helps!

Alternatively you can try to rescan the wallet file if you have it still. ./bitcoind  -rescan

Cheers sir

[mpalenciac]

http://www.linuxlinks.com/article/20100226123335414/TestDisk.html

Use test disk to recover your old wallet files / privkeys.

I hope this helps!

Alternatively you can try to rescan the wallet file if you have it still. ./bitcoind  -rescan

Cheers sir

Thanks dude, I already did -rescan but nothing, I'm wondering if there's anything else, or if maybe you know about ext4 online file recovery.

[MRKLYE]

You have access to the web server you sent hte BTC off of?

[mpalenciac]

You have access to the web server you sent hte BTC off of?

Yes, I do.

[MRKLYE]

Seems those change addresses are still being used.. you have a .00001 sent 15 blocks ago to the address with 1.32 BTC in them..

Weird!

[Dare]

If you made a sufficient number of transactions on the server wallet, bitcoind may have generated new change addresses to use, which are not included in the copy of the wallet you have from the laptop.

Depending on the level of access you have access to the server, I suggest either recovering the wallet from the server (only possible if it wasn't permanently deleted), restoring the server wallet from a (very) recent backup that's newer than the laptop wallet, or powering down the server ASAP, cloning it with a tool such as dd, and attempting to recover deleted files from the image with KeyHunter and similar tools.

The last option may work if all else fails, but requires root access (if not hardware access, since cloning it after it's shut down is preferable) to be done properly. Any further usage of the server risks overwriting what's left of the file, which may well be all of it (especially if the server is lightly used and/or has plenty of disk space free), so if the server isn't critical that's your best option. If you power it down and image it, you can start it back up again and try everything on the image without any further risk of data loss. Otherwise, you can run KeyHunter on the block device (/dev/sd#), though the longer the server's in use the greater the chance that the file will be overwritten.

[mpalenciac]

If you made a sufficient number of transactions on the server wallet, bitcoind may have generated new change addresses to use, which are not included in the copy of the wallet you have from the laptop.

Depending on the level of access you have access to the server, I suggest either recovering the wallet from the server (only possible if it wasn't permanently deleted), restoring the server wallet from a (very) recent backup that's newer than the laptop wallet, or powering down the server ASAP, cloning it with a tool such as dd, and attempting to recover deleted files from the image with KeyHunter and similar tools.

The last option may work if all else fails, but requires root access (if not hardware access, since cloning it after it's shut down is preferable) to be done properly. Any further usage of the server risks overwriting what's left of the file, which may well be all of it (especially if the server is lightly used and/or has plenty of disk space free), so if the server isn't critical that's your best option. If you power it down and image it, you can start it back up again and try everything on the image without any further risk of data loss. Otherwise, you can run KeyHunter on the block device (/dev/sd#), though the longer the server's in use the greater the chance that the file will be overwritten.

Thank you so much, doing this right now. It has over 70% free space and I already took a snapshot of it, let's see how it goes

[zvs]

Unmount it, read only, use scalpel or extundelete on wallet.dat.  never used/heard of keyhunter.  

ed: like this http://linuxpoison.blogspot.com/2010/09/utility-to-recover-deleted-files-from.html       (it seems not to have mentioned it, but obv you wouldnt want to download *extundelete on the disk you're trying to recover files from)

[Dare]

Unmount it, read only, use scalpel or extundelete on wallet.dat.  never used/heard of keyhunter. 

ed: like this http://linuxpoison.blogspot.com/2010/09/utility-to-recover-deleted-files-from.html       (it seems not to have mentioned it, but obv you wouldnt want to download *extundelete on the disk you're trying to recover files from)

Keyhunter is a Bitcoin-specific tool that looks for private key data in whatever you feed to it, up to and including a disk image (which it was designed for). The creator made a blog post about it here, but I don't remember where I first found it; either somewhere here, /r/bitcoin, or Twitter. Since it's just looking for the magic number before each private key and not for the entire wallet file record, it may work slightly better than a standard tool, but either or both could work (I personally use Recuva on Windows, and I've heard of people having some success with Photorec; there's plenty of options available).

[jackjack]

You can try pywallet

[CryptInvest]

I'm having a gigantic issue with BTC wallet, it's a long story but I'll try to explain myself in the best way possible,  basically my 1.6 btc from my wallet are gone.

I used to do my entire work from my laptop and it died out on me a few days ago on the 16th actually.
This is my wallet address https://blockchain.info/address/15fqQ7a8fpugjfcQL4hj734FLvVjV8zgua
I was able to copy the wallet.dat by taking it out of the laptop's drive and copying it into my server for a few days, I made some transactions from there, actually all transactions from the 17th onward were made from the server.
I deleted the server's bitcoin folder once I did the transactions I needed but kept the wallet.dat from the laptop in a USB key.
I copied this wallet.dat to the new computer, synced and the BTC weren't there.
These are the transactions that took place from the server and generated new addresses with the "change".

I sent 0.8 BTC on this TX, it created 1.32 btc as change in a new address:
3641d7ffcfa0fd9aba036a46d753730691ae008b9cbac3e7bd3feb37885407ca

I sent 0.01 BTC on this TX, it created 0.365 as change in a new address:
bc12327475b3c71a134f18076cf13453bba4bfaaba080ab5ba1d348fcb9e0a6f

when I synced using the backup today, all my wallet's showing is 0.09 btc.
The addresses generated by the "change" can't be seen from my wallet, I can't get their privkeys or anything. I only have the privkey from the address that received the funds originally which is 15fqQ7a8fpugjfcQL4hj734FLvVjV8zgua

Any help would be greatly appreciated, I've got a 0.5 BTC bounty for whoever helps me out fix this and get my funds back.

Thank you



EDIT: I forgot to mention that I'm using bitcoin-qt on linux and the Transactions were made from bitcoind on a server.

Well, managed to restore the purse?

[BigGameCAsino]

Weird. Had some issues like that before. I got 2.056 BTC and my laptop crashed. Got my hard drive repaired, recovered the files and instead of 2.056, I got 2.090 credit in my account. Hmmm I dont think that was a delayed transaction because I havent used my account for months.

[pandalion98]

Most probably it's still there as long as you were sure that the drive wan't really busy when you deleted your wallet.

Try using different recovery software on the drive itself or the clone.

[thesims]

why it is so weird...cant understand