Quote from: Boss3010 on May 14, 2025, 11:22:59 AM

So, I decided to use some data recovery tools, and fortunately, one of them managed to recover a .gpg file—although it was restored with a random name. The file is 165 MB in size and has a .gpg extension.
I ran a full strings scan on it, and it was filled with keywords like “btc”, “wallet”, “xprv”, “priv”, and “key”. I also noticed the beginnings of old Bitcoin addresses. However, all the matches were small fragments—no complete sentences or full addresses.
Then I used the gpg --list-packets command to analyze the file structure. It showed that the file is encrypted using RSA (Key ID starting with 5EB…), with algorithm 3 and an encrypted data packet of length 6284 bytes.

Which data recovery tools did you use?

I would assume that an encrypted file with extension .gpg doesn't really have any meaningful strings in it. It's all encrypted, isn't it?

Your data recovery tool may have found chunks of data, possibly from a wallet.dat file, and attributed it to be a GPG file because it found chunks of encrypted data. It's possible that what your recovery tool found isn't quite correct. But I'm just speculating a bit based on what you provided.

I guess there's not much you can do, if you can't remember having created a GPG file, haven't documented anything about it and most importantly haven't documented any decryption details. Having no backups of wallet files is a somewhat common problem of early bitcoiners (don't want to lump everyone together; those who have don't show up in the forum with recovery issues).

If you're searching for valuable data, make sure you don't alter the storage media, especially when you have to assume to recover potentially deleted files from some filesystems. I would highly recommend to make forensic bit-by-bit copies of storage media (read-only access to the storage media devices) and work only on copies of such forensic copies. The basic principle is to never alter the original storage media.

Quote from: DannyHamilton on May 23, 2025, 03:10:51 PM

(I've been on this forum WAY too long. I'm getting cynical in my old age)

In many cases your assumption isn't wrong... Grin