Hello, today I bring you a classic.
I am trying to recover a wallet.dat with
date Feb 2014 of which I DO NOT REMEMBER THE KEY !!!
Wait, wait ... Don't go yet, this gets better ...
Actually, I remember half of the password, so I downloaded
btc-qt v0.21.0 and loaded the wallet and, initially, there was no problem and I loaded it without errors. Indeed, the wallet is encrypted.
Well, I downloaded
btcrecover , as I said, I will only need 4/5 characters to get it and I have a couple of powerful GPUs ...
So I have tried btcrecover with a wallet of
btc-qt v0.21 (just created, so I know the key) and I made it difficult for btcrecover.
After 19million passwords I got the correct one. At this point, I tried the
wallet from 2014 and there was no way. HOWEVER, I had other
wallets from 2015 (ltc, doges) and another from btc from 2016 of which I DID NOT REMEMBER THE KEY. The 2015 ones I didn't get any
but the 2016 btc one did found it (I put patterns, etc and it took it out after 3h testing).
Furthermore, the size of the 2014 wallet is 70kb while an empty wallet from 2021 is 1.5mb I downloaded a snapshot of
Arch Linux from 2014 that included the
btc v0.9.0 , with which I created the original wallets and
YES it's size is 70kb . I changed the passphrase of this one and the key was recovered by
btcrecover .
I thought that the format of the Wallet would be different but ... no. I still find it very strange that I do not get the btc key but I do with the other currencies / versions ...
I passed the wallets through the
bitcoin2john.py (which I don't know very well what it does, I suppose it decrypts it ... but without a password or anything? Any ideas?) And it got me the next.
# BTC2014 $ bitcoin $ 64 $ 6a750G4ef1867cff00d941df3d1165c39164b4273aca3c7e57af5adf60183945 $ 16 $ 83c69fe19b89ab31 $ 81501 $ 2 $ 00 $ 2 $ 00
# DGE2015 $ bitcoin $ 64 $ cf76aeFba7fb934a2bec1188374c4e6ba48eec8420a6d31ed60938bfb338f7c5 $ 16 $ 7c764655dce776eb $ 76294 $ 2 $ 00 $ 2 $ 00
# LTC2015 $ bitcoin $ 64 $ 46566411G6f01f736a5b3034a6f08c243c56b2a80f8efae989b82c7f6ce9a16a $ 16 $ 043d2183deb8a8f0 $ 83 052 $ 2 $ 00 $ 2 $ 00
# BTC2016 $ bitcoin $ 64 $ 51af538da4S6ea0ef645c1f3e48235bc154fd223b6b80055384cb23b9b349274 $ 16 $ 41cd67deea8c4a99 $ 292912 $ 2 $ 00 $ 2 $ 00
# BTC2021 $ bitcoin $ 64 $ 7c2ccf1efA605be8bd2b6a5976fb82e1347a3b379212ef2ce06e4bd642fdea80 $ 16 $ 441c84e628c44f46 $ 269046 $ 2 $ 00 $ 2 $ 00
As you can see,
those of 2014 and 2015 have one less character. I don't know if this has something to do with it or not.
The
btc-qt v0.21 does not give me errors when loading the 2014 and 2015 wallets , in fact it detects the movements that there were. The btcrecover does not show any error either (I don't know, something like the wallet was not formatted correctly or something like that, but no ...)
I'm also not sure what each fields represents:
$ bitcoin => currency?
$ 64 => 64 bytes of encryption
$ 6a75 ... 945 => key that I am looking for?
$ 16 => no idea ...
$ 83c69fe19b89ab31 => no idea ... (I have read some salt, which I think is how it is encrypted)
$ 81501 => no idea ...
$ 2 => no idea ...
$ 00 => no idea ...
$ 2 => no idea ...
$ 00 => no idea ...
At this point, I'm a bit stuck. I'm not sure what to do... Before leaving computers for eons trying to get the password, I prefer to exhaust the possibilities and understand well the fields of wallets and everything that surrounds them.
So my doubts are:
1. What does bitcoin2john.py do?
2. What does each field of the wallet represent? ? Link with info?
3. Any ideas about wallet versioning?
4. Any place where I can find technical information of this level?
5. And more importantly ... Any ideas to keep trying to decrypt the wallet? PS: In 2015/2016 I took out almost all the bitcoins, there were only a few satoshis that today are worth 8€ ... so it pisses me off, but I don't want to commit suicide thinking I'm a millionaire xD