Search content
Sort by
Showing 20 of 111 results by Igor76200
I found one encrypted address
"mkey": {
"encrypted_key": "1665e0b9375c20a720c77799a7386eba77149b97bd34ebce42ee962882da8a3abfe566040b7aae4 5e941880972dc7a8b",
"nDerivationIterations": 62166,
"nDerivationMethod": 0,
"nID": 1,
"otherParams": "",
"salt": "96d596871f9a2dcc"
},
you can check password on this encrypted_key
here is guide
https://bitcointalk.org/index.php?topic=140912.msg7690647#msg7690647
if your password works this will be your wallet with bitcoin
"mkey": {
"encrypted_key": "1665e0b9375c20a720c77799a7386eba77149b97bd34ebce42ee962882da8a3abfe566040b7aae4 5e941880972dc7a8b",
"nDerivationIterations": 62166,
"nDerivationMethod": 0,
"nID": 1,
"otherParams": "",
"salt": "96d596871f9a2dcc"
},
you can check password on this encrypted_key
here is guide
https://bitcointalk.org/index.php?topic=140912.msg7690647#msg7690647
if your password works this will be your wallet with bitcoin
It's been a while since I last checked this thread.
I will try ! But there is little chance it's the winning wallet. There was many encrypted wallets on this disk.
I realized that I had made a mistake.
The previous recycler was created at 15 November 2013 and lived up to 1 February 2014 and the last modification was at 29 January 2014.
On 1 February 2014 the second recycler was created which still is the current bin and it was last modified at 25 February 2021.
So that is not too long ago and I would tend to conclude that OP overwrote his own wallet less then two weeks ago.
Why would you write onto a drive that you are trying to recover ?
The previous recycler was created at 15 November 2013 and lived up to 1 February 2014 and the last modification was at 29 January 2014.
On 1 February 2014 the second recycler was created which still is the current bin and it was last modified at 25 February 2021.
So that is not too long ago and I would tend to conclude that OP overwrote his own wallet less then two weeks ago.
Why would you write onto a drive that you are trying to recover ?
I'm just re reading your message. I need to recapitulate.
- First bin was created nov 15 2013 : that was the old owner. Before I bought the Laptop.
- On January 7th 2014 I created my Bitcoin wallets. Including the wallet we are searching now.
I deleted this wallet immediately. It was on the computer probably only a few hours.
- Second bin was created February 1st 2014.
That mean I put the wallet in the first bin.
If I understand correctly, I need to look for old lost partitions and locate the first bin ?
@escobol I scanned C (the current vhd file is C) and then recovered the files on D. The program suggested to send those files on a different drive in order to avoid data loss.
He overwrote it himself a few days ago and he knows it.
Know it what ? Because I used the recovery programs on the same disk ?
How can you be so sure it overwrote everything ?
If you do a search with Wondershare recovery those two ballet.dat are still visible.
Sorry I forgot to answer about that point... in late February I scanned C drive with the recovery software and pasted them on the D drive (I did not added the vhd of D I don't think it's there).
Current state of search :
Found 22 altcoin wallets and 38 other wallets, while scanning .db files : Berkeley DB (Btree, version 9, native byte-order)
17 wallets with a size of 9 bytes which is impossible to recover
21 wallets of 29 bytes many of these can not be dumped because encrypted.
Now have to check the ones that are encrypted and their files size this will show if it can be done and be used as an indicator for the amount of effort it will take to try.
We know the wallet is encrypted so it all does make sense at this point in time. Will require further investigation likely examination on the bit level.
A wallet has a specific structure, for example like a start header and end header. Positions of the elements in between is fixed so we know what should be where after a certain start header and before a certain end header.
This means you drag a partial overlay over the remaining data and when it slides over a old damaged wallet, and there are still elements present then the overlay will match and ID the underlaying data and we make a snapshot of that for further examination.
If there are enough bits left on the drive then you would be able to recover the coins.
The 9 bytes wallets mentioned earlier are the standard that gets written in case of failure. Those look like this:
main
\00\00\00\02
DATA=END
It is empty, but it can be empty for many reasons that is why you have to compare those nine bytes to the original file. If the original file is larger then it means that there is more then those nine bytes.
Quote
Found 22 altcoin wallets and 38 other wallets, while scanning .db files : Berkeley DB (Btree, version 9, native byte-order)
17 wallets with a size of 9 bytes which is impossible to recover
21 wallets of 29 bytes many of these can not be dumped because encrypted.
Now have to check the ones that are encrypted and their files size this will show if it can be done and be used as an indicator for the amount of effort it will take to try.
We know the wallet is encrypted so it all does make sense at this point in time. Will require further investigation likely examination on the bit level.
A wallet has a specific structure, for example like a start header and end header. Positions of the elements in between is fixed so we know what should be where after a certain start header and before a certain end header.
This means you drag a partial overlay over the remaining data and when it slides over a old damaged wallet, and there are still elements present then the overlay will match and ID the underlaying data and we make a snapshot of that for further examination.
If there are enough bits left on the drive then you would be able to recover the coins.
The 9 bytes wallets mentioned earlier are the standard that gets written in case of failure. Those look like this:
main
\00\00\00\02
DATA=END
It is empty, but it can be empty for many reasons that is why you have to compare those nine bytes to the original file. If the original file is larger then it means that there is more then those nine bytes.
Some infos that might be useful.
Computer is a ASUS netbook Eee PC 1001PX
Disk is WDC WD2500BEVT-80A23T0
I bought this laptop second hand on EBay in January 2014.
I made a system restoration then created all my crypto wallets January 7th 2014.
In total about 20 altcoins wallets and 5-6 Bitcoin wallets.
That particular bitcoin wallet I'm looking for was created on this laptop, I immediately made a copy on a SD card then deleted the original file. I think it was on this computer only for a few hours.
Does this have any importance ?
I rarely used that laptop since because it's old stuff.
I probably messed with windows at some point, because I can see there is an unverified version of windows running. I really can't remember what I did...
File should be named « ballet.dat » and « ballet_1.dat » (original + copy)
Computer is a ASUS netbook Eee PC 1001PX
Disk is WDC WD2500BEVT-80A23T0
I bought this laptop second hand on EBay in January 2014.
I made a system restoration then created all my crypto wallets January 7th 2014.
In total about 20 altcoins wallets and 5-6 Bitcoin wallets.
That particular bitcoin wallet I'm looking for was created on this laptop, I immediately made a copy on a SD card then deleted the original file. I think it was on this computer only for a few hours.
Does this have any importance ?
I rarely used that laptop since because it's old stuff.
I probably messed with windows at some point, because I can see there is an unverified version of windows running. I really can't remember what I did...
File should be named « ballet.dat » and « ballet_1.dat » (original + copy)
I don't know about the hex search but opening them with the notepad you can see a lot of nonsense (windows media script...). So yes they seem highly damaged.
I can confirm they are the correct files. Because of their creation date. They were created the right day and hour... no mistake possible.
I can confirm they are the correct files. Because of their creation date. They were created the right day and hour... no mistake possible.
Oh wait... could someone confirm it's actually useless to make a raw disk search for encrypted wallets ?
This thing is so frustrating because there is just too many things I don't understand.
Will post on bitcoin stack as well. Hopefully some bitcoin engineer with 150IQ will be able to try something.
This thing is so frustrating because there is just too many things I don't understand.
Will post on bitcoin stack as well. Hopefully some bitcoin engineer with 150IQ will be able to try something.
No I gave random names to differentiate between all my wallets.
There seem to be two recovery businesses operating
David from https://walletrecovery.info/
Dave from https://walletrecoveryservices.com/
I contacted David but got no answer from Dave so far. Not sure what happened.
If you open the file with windows notepad, it's completely unreadable. The program still managed to compile the crap under the right name. But seems overwritten.
Right now I think I should do
1. Rescan with Pywallet + passphrase
2. Raw partition search for keys or key fragments (I can't do that myself)
3. Forensic data recovery lab. But I don't even know what to tell them. They probably don't know so much about private keys and stuff
There seem to be two recovery businesses operating
David from https://walletrecovery.info/
Dave from https://walletrecoveryservices.com/
I contacted David but got no answer from Dave so far. Not sure what happened.
If you open the file with windows notepad, it's completely unreadable. The program still managed to compile the crap under the right name. But seems overwritten.
Right now I think I should do
1. Rescan with Pywallet + passphrase
2. Raw partition search for keys or key fragments (I can't do that myself)
3. Forensic data recovery lab. But I don't even know what to tell them. They probably don't know so much about private keys and stuff
Thank you much appreciated.
Here is the links to the .dat files (original+copy)
The original title on disk was ballet.dat and ballet_1.dat
They are highly damaged. There is not much to see.
http://www.filedropper.com/wallet_5
http://www.filedropper.com/wallet1
Here is the links to the .dat files (original+copy)
The original title on disk was ballet.dat and ballet_1.dat
They are highly damaged. There is not much to see.
http://www.filedropper.com/wallet_5
http://www.filedropper.com/wallet1
problem it is store on encrypted keys is very hard to crack
I have the password. 100%... You can't crack it. It's as complex as the private key itself +special characters.
if want to try yourself
use python 2.7 from Miniconda2
use python 2.7 from Miniconda2
Thanks I will try tonight.
In case there is missing bits in the key, I guess Pywallet will not report it ?
That's another thing to consider. A deep analysis is necessary to be really sure.
You are sure that You want to share vhd like that?
Yes password is strong. This laptop have no value for me, there is nothing important on the disk.
I made a brand new thread for this... is that alright mods 
-> https://bitcointalk.org/index.php?topic=5321900.msg56497491#msg56497491
Will reply there
-> https://bitcointalk.org/index.php?topic=5321900.msg56497491#msg56497491
Will reply there
Yes you can't crack the password. I'm ready to visit that person, or the other way around, preferably in the EU due to travel restrictions. In order to make the transaction safer. I guess that's the safest way to do it.
I lost a .dat wallet with 1.54BTC.
I managed to find the .dat file by scanning the original laptop used to create the wallet from 2014. Unfortunately the file seem to be highly damaged. Someone tried to extract the keys using Pywallet but it failed.
I am looking for a deep disk partition research, in order to find the key. Unfortunately I am not capable of doing this.
I am willing to give 10% to the person able to succeed. If that's even possible. Which is around ~7500$ now.
I created an image of the disk. Here
https://mega.nz/file/ux4WQLDB#cc_OHpVKRNszxDrnl5Y4A1GwzfszlNNpVJwi43vtXJY
Address : 1FHYSH65uKdVGhR7Y2QznxfBtLWhjotqUq
https://www.blockchain.com/btc/address/1FHYSH65uKdVGhR7Y2QznxfBtLWhjotqUq
More infos
It's an old netbook from 2010 or even older. I bought it just to create the wallets. I rarely use it because it's very old and slow. 60% of the disk is free. I can't remember what I did with this laptop... maybe I reinstalled windows at some point. I'm not sure.
I created about 20 altcoin wallets and 5 bitcoin wallets with that computer. So there might be other keys around.
If it fail, my last option would be to submit the disk to a forensic data recovery lab. Maybe they will be able to find something.
Crossing fingers. Thanks !
I managed to find the .dat file by scanning the original laptop used to create the wallet from 2014. Unfortunately the file seem to be highly damaged. Someone tried to extract the keys using Pywallet but it failed.
I am looking for a deep disk partition research, in order to find the key. Unfortunately I am not capable of doing this.
I am willing to give 10% to the person able to succeed. If that's even possible. Which is around ~7500$ now.
I created an image of the disk. Here
https://mega.nz/file/ux4WQLDB#cc_OHpVKRNszxDrnl5Y4A1GwzfszlNNpVJwi43vtXJY
Address : 1FHYSH65uKdVGhR7Y2QznxfBtLWhjotqUq
https://www.blockchain.com/btc/address/1FHYSH65uKdVGhR7Y2QznxfBtLWhjotqUq
More infos
It's an old netbook from 2010 or even older. I bought it just to create the wallets. I rarely use it because it's very old and slow. 60% of the disk is free. I can't remember what I did with this laptop... maybe I reinstalled windows at some point. I'm not sure.
I created about 20 altcoin wallets and 5 bitcoin wallets with that computer. So there might be other keys around.
If it fail, my last option would be to submit the disk to a forensic data recovery lab. Maybe they will be able to find something.
Crossing fingers. Thanks !