Post
Topic
Board Bitcoin Technical Support
Merits 1 from 1 user
Re: Treasure Hunt - Recover wallet.dat from JAN2010
by
furyo87
on 12/02/2021, 00:20:57 UTC
⭐ Merited by ETFbitcoin (1)
I ran the bitcoin client for a couple of days in January 2010.
I am using Recuva to try and recover Wallet.dat.

Does this filename ring any bells?

INFO "Filename: 49C7D454d01 Path: D:\?
Size: 30.6 KB (31,348)
State: Very poor
Creation time: 1/31/2010 19:59
Last modification time: 1/31/2010 19:59
Last access time: 1/31/2010 19:59
Comment: This file is overwritten with "D:\Programas\Mozilla Firefox\chrome\pippki.jar.moz-backup"
6 file cluster(s) overwritten (0, 1, 2, 3, 4, 5)
4 cluster(s) allocated at offset 6301398 4 cluster(s) allocated at offset 6305132"

Cheers
You'll most likely need the full file to be able to get the coins/private keys out.
Is that the original file name or is it a name added by the recuva recovery software? It has to be wallet.dat in order for you to get anything. Also, the file is quite small and the signatures it leaves as a trace will be small (the wallet.dat file, not this specific one).

Thank you for your comment ~2,5 years ago! I am going to restart this treasure hunt...

I have spent a couple of hours going through the most recent threads about wallet.dat file recovery or extraction of private keys.
I will lay out my game plan and would appreciate all comments and suggestions.
I will reiterate my problem as I don't think I was clear enough initially:

Background
  • I believe I ran the Bitcoin client around January 2010 - I am pretty sure it was before July 2010 and I am certain I struggled with stability issues to keep it running over a few nights
  • In 2017 propped by one of the pump in BTC price I grabbed my old hard drive to see if I could find the wallet files - nothing was found and I assume the drive was either formatted or the file overwritten
  • I came across the following thread: https://bitcointalk.org/index.php?topic=22697.0 and unfortunately proceeded to run Recuva on the original hard drive without making one/various clones - big mistake, I understand
  • My original post shows what I found then to be the most promising results - and you clearly can understand how limited my knowledge of this matter is.
  • The HD was connected to my PC since 2017 but it was not used for booting nor accessed
  • I have been approached by a couple of persons via PM which I have not seriously engaged with out of being afraid of a scam. Simultaneously, this approaches do provide some hope.

Summary
  • I am not sure if I was actually awarded any BTC when I ran the client
  • My wallet file was likely overwritten or deleted in during a HD format
  • I put my Changes of Success at under 5% but with BTC approaching 50k I feel like I can dedicate a few days to this

Plan
1. Clone the old hard drive (it is currently disconnected from Desktop)
Planning to use: https://hddguru.com/software/HDD-Raw-Copy-Tool/ as I have seen it recommend around by trusted member ETFBitcoin
  • Can I use a partitioned External USB Drive or should I buy an HD to clone to?
  • Would you recommend another program for a second clone?
2. Run pywallet (ref. Thread https://bitcointalk.org/index.php?topic=5161349.0, I understand jackjack is debugging so I will allow some time)
3. Try findwallet (ref. https://bitcointalk.org/index.php?topic=5071775.0)
4. Try Rstudio or other recovery software (ref. https://bitcointalk.org/index.php?topic=2637884.0)
5. Delivery it to the pros at Wallet Recovery Services (not sure if they accept forensic cases)

Credits
https://bitcointalk.org/index.php?topic=5308461.0#post_CorruptedDisk
https://bitcointalk.org/index.php?topic=4959742.msg44708601#msg44708601

Cheers!