Quote from: ice-gram on July 15, 2021, 02:53:05 AM

Thanks for all your replies.

Quote from: ETFbitcoin on June 19, 2021, 09:53:09 AM

However, there are few other magic bytes you could try such as 62 31 05 00 09 00 00 00 according to https://bitcoin.stackexchange.com/a/41450.

I tried but couldn't find anything. I also tried the other bytes in the linked post. I found some results for "defaultkey" but what follows the string is "site-packages/route.py". I guess it's from some other apps and not what a normal wallet.dat file contains?

Quote from: HCP on June 24, 2021, 02:22:54 AM

Did you try any data recovery tools? Huh

Or did you just make an image of the drive and search through the image? Huh

Yes, I first tried some data recovery tools such as disk genius. I couldn't find any file named "wallet.dat" and got thousands of unnamed files which are impractical to go through manually.

Quote from: BASE16 on June 24, 2021, 05:33:08 PM

Mount the disk read only in linux and use photorec to copy all files that are found to another harddisk, and then look for files that have .db extension.
If you find any of those use the file <filename> command to examine the exact file type and if its a Berkeley DB Btree then it's most likely your wallet.
Photorec works on RAW data so it will not restore actual filenames like for example wallet.dat.
In stead it will give each file it finds a number, and look at the bytes and try to figure out the filetype from that so it does not matter how many times you formatted the drive if the bytes are still there then you will find it.

See here for more: https://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
This tutorial suggests to try testdisk first but in your case it is best you start with Photorec directly.

Thank you very much. I tried this software. I looked for .db files and couldn't find anything. Looking for other types of files yields some results. I wonder if I should look for all types and turn on options like "brute force"?

Ok so the best thing you can do is to look for files like jpg and png, these are image files and if it finds any you open them and see if they are from the previous system installation.
If that is the case then you found proof that there is residual data from the former installation still on that disk.
This is likely because when you reinstall the operating system it will usually do a soft format by just wiping the partition table and leaving the old data it'self intact.
If you really wanted to destroy the data it would have be overwritten by manually making a total format which could take a very long time for big disks, or you would have had used the new operating system extensively and filled up the drive to near full capacity thereby also overwriting the old data.
So if you can find any files that belong to the previous installation, then this indicates that you need to do a deeper scan