Search content
Sort by
Showing 5 of 5 results by Shirase
Are you on Windows? Or Mac?
I'm going to assume Windows.
Download WinHex: https://www.x-ways.net/winhex/
Unzip it. (If you don't know how to do this, tell us which version of Windows you're running. It could be Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP... The process changes slightly depending.)
Right Click WinHex.exe. (It may just be called WinHex. The icon will look like this:
https://i.imgur.com/RdWDVSZ.png
Run it as administrator. (Needed to do a raw byte search of the disk.)
https://i.imgur.com/HuEkazY.png
You then may have to allow it which again will vary slightly depending on which Windows you're running.
Go to tools, open disk.
https://i.imgur.com/OPTT0mG.png
Select your recovered drive and click OK.
It will begin traversing the drive:
https://i.imgur.com/G1BZjLG.png
You can click the x. It will ask if you want to abort. Click yes.
Go to search, find hex values. You will get a window that looks like this:
https://i.imgur.com/xPhKBf9.png
Type 0420 into it exactly as shown.
Click OK. After some amount of time, the window should find an instance of it. There will be a blinking cursor highlighting it on the window.
https://i.imgur.com/bKMkS8N.png
This is (probably) not the start of your private key. It's just to make sure your hard drive isn't totally messed up. (It's pretty unlikely any given two bytes would not be found on a used hard drive. If it's really not found as you claim, you're probably out of luck.)
If it found something, go to search, find hex values again. Enter this value:
308201130201010420
https://i.imgur.com/nKojITh.png
Click OK. This search could take a LONG time depending on the size of the harddrive. Expect to wait at least a few hours.
If it finds a result, just as before, the cursor will be blinking at the start of the result. Your private key is (probably) after the 0420 after the cursor. Write down the 64 digits following 0420 (including the letters) and show no one anything related to these 64 digits. It will allow them to steal your money.
Edit: After you have written down the digits, go to search, continue search. If another result is found, once again, write down the 64 digits after the 0420 again. Then go to search, continue search again. (Unless the digits are identical.)
If you see this instead:
https://i.imgur.com/GNh1Xmd.png
You're probably out of luck. But I could write similar step by step instructions for PyWallet. (I probably should have done that in the first place that you mentioned searching for 0420 locked my mind into this hex search method.)
I'm going to assume Windows.
Download WinHex: https://www.x-ways.net/winhex/
Unzip it. (If you don't know how to do this, tell us which version of Windows you're running. It could be Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP... The process changes slightly depending.)
Right Click WinHex.exe. (It may just be called WinHex. The icon will look like this:
https://i.imgur.com/RdWDVSZ.png
Run it as administrator. (Needed to do a raw byte search of the disk.)
https://i.imgur.com/HuEkazY.png
You then may have to allow it which again will vary slightly depending on which Windows you're running.
Go to tools, open disk.
https://i.imgur.com/OPTT0mG.png
Select your recovered drive and click OK.
It will begin traversing the drive:
https://i.imgur.com/G1BZjLG.png
You can click the x. It will ask if you want to abort. Click yes.
Go to search, find hex values. You will get a window that looks like this:
https://i.imgur.com/xPhKBf9.png
Type 0420 into it exactly as shown.
Click OK. After some amount of time, the window should find an instance of it. There will be a blinking cursor highlighting it on the window.
https://i.imgur.com/bKMkS8N.png
This is (probably) not the start of your private key. It's just to make sure your hard drive isn't totally messed up. (It's pretty unlikely any given two bytes would not be found on a used hard drive. If it's really not found as you claim, you're probably out of luck.)
If it found something, go to search, find hex values again. Enter this value:
308201130201010420
https://i.imgur.com/nKojITh.png
Click OK. This search could take a LONG time depending on the size of the harddrive. Expect to wait at least a few hours.
If it finds a result, just as before, the cursor will be blinking at the start of the result. Your private key is (probably) after the 0420 after the cursor. Write down the 64 digits following 0420 (including the letters) and show no one anything related to these 64 digits. It will allow them to steal your money.
Edit: After you have written down the digits, go to search, continue search. If another result is found, once again, write down the 64 digits after the 0420 again. Then go to search, continue search again. (Unless the digits are identical.)
If you see this instead:
https://i.imgur.com/GNh1Xmd.png
You're probably out of luck. But I could write similar step by step instructions for PyWallet. (I probably should have done that in the first place that you mentioned searching for 0420 locked my mind into this hex search method.)
Assuming Mac or Windows, wouldn't the deleted file just end up in Trash or the Recycle bin? (Even some linux distros have a similar concept.) Since this was so recent, it should probably still be in there. Or did you very specifically configure the computer to totally delete the file (or... did you empty the trash yourself too... 
)? Because that's usually not the default.
)? Because that's usually not the default.It should be 64 digits (0-9 or A-F hexadecimal) or 32 bytes.
For instance, here's the "bitcoin is awesome" brain wallet in hexadecimal
23D4A09295BE678B21A5F1DCEAE1F634A69C1B41775F680EBF8165266471401B
To get it in WIF format, you can use an offline version of https://www.bitaddress.org/
Click download under the donation link, put it on a thumbdrive, take it to a computer with no internet access. (Preferably one where internet access can be hardware disabled.) Unzip it, double click bitaddress.org.html.
Click "Wallet Details". In "Enter Private key", type your digits. Click "View Details". It will give you a public and private key in various formats. Go to a different computer with online access. (Or use your phone) and verify the public address given has the balance you are expecting.
In the case of "bitcoin is awesome", its public address (listed under the "Bitcoin Address" and a QR code on the left) is: 14NWDXkQwcGN1Pd9fboL8npVynD5SfyJAE
You can append the public address to this url: https://blockchain.info/address/
Like this:
https://blockchain.info/address/14NWDXkQwcGN1Pd9fboL8npVynD5SfyJAE
To check its transactions. If it is the proper wallet with the balance you expect, write down the private key from it in WIF format from bitaddress.org. For "bitcoin is awesome" it's: 5J64pq77XjeacCezwmAr2V1s7snvvJkuAz8sENxw7xCkikceV6e
For instance, here's the "bitcoin is awesome" brain wallet in hexadecimal
23D4A09295BE678B21A5F1DCEAE1F634A69C1B41775F680EBF8165266471401B
To get it in WIF format, you can use an offline version of https://www.bitaddress.org/
Click download under the donation link, put it on a thumbdrive, take it to a computer with no internet access. (Preferably one where internet access can be hardware disabled.) Unzip it, double click bitaddress.org.html.
Click "Wallet Details". In "Enter Private key", type your digits. Click "View Details". It will give you a public and private key in various formats. Go to a different computer with online access. (Or use your phone) and verify the public address given has the balance you are expecting.
In the case of "bitcoin is awesome", its public address (listed under the "Bitcoin Address" and a QR code on the left) is: 14NWDXkQwcGN1Pd9fboL8npVynD5SfyJAE
You can append the public address to this url: https://blockchain.info/address/
Like this:
https://blockchain.info/address/14NWDXkQwcGN1Pd9fboL8npVynD5SfyJAE
To check its transactions. If it is the proper wallet with the balance you expect, write down the private key from it in WIF format from bitaddress.org. For "bitcoin is awesome" it's: 5J64pq77XjeacCezwmAr2V1s7snvvJkuAz8sENxw7xCkikceV6e
You don't necessarily need a CD. Do you have a USB stick lying around with like 4GB you can use for this? (exclusively for this, everything else on it would be formatted/deleted. But you could use the stick again once you're done.) If you're willing to spend $200 on a bounty, you should definitely be willing to buy a USB thumbdrive, assuming you don't have one around.
Maybe have two, one can be small since it only needs to hold your wallet.dat files and the wallet-recover program rather than a whole OS.
You're on a mac, but you had said we could provided step by step instructions for Windows as well.
Linux Live USB creator will allow you to turn most bootable .iso files (CDs) into bootable USB files. There are other programs that do this, maybe someone else can post one that has been updated more recently...
You can download the portable version here so you don't have to install it: https://www.linuxliveusb.com/en/other-versions
You can download Ubuntu from here: https://www.ubuntu.com/desktop (It encourages donations, but don't worry, it's free. Just click, "Not now, take me to the download")
You should end up with an .iso file.
Extract the LinuxLive USB creator .zip file. Open LiLi USB Creator. Select the drive letter for the thumbdrive you want to use for the OS in Step 1. Click ISO/IMG/ZIP under step 2. Choose the ubuntu iso file. It will say the latest Ubuntu is not found, and will use settings for Ubuntu 15.04. That's fine.
Step 3 is for "Persistence". Drag the slider all the way to the right.
In step 4, check Format the key in FAT32.
Check, double check, triple check that the drive letter is for your thumb drive.
Click the Lightning bolt. It will take a bit of time, but will update you on progress below the lightning bolt.
https://i.imgur.com/4Fuxx5w.png
When finished it will say "Your LinuxLive key is now up and ready!" under the lightning bolt. Get another USB thumbdrive. (Easiest, so the program runs for less time since you can search only the specific drive they're on.) Copy your wallet.dat files to it. Download wallet-recover from here: http://makomk.com/~aidan/wallet-recover and place it on the stick next to your wallet.dat files. (same link as the one from the topic sgravina shared, feel free to get it from there) Safely remove this USB thumbdrive from your computer.
Turn off your computer, and boot from the USB thumbdrive with Ubuntu on it. Unfortunately, how this is done varies from bios to bios. On most of my computers continually pressing f11 and f12 immediately after starting the computer opens the boot menu. Select the USB stick with Ubuntu on it using the arrow keys and enter. (This varies too, but usually you do not have access to mouse controls in BIOS menus).
If you can get this far, it's very good because there are a lot more tools and support here for linux than anything else.
It will boot after a bit. You'll see a giant window with "Try Ubuntu" and "Install Ubuntu". You want try.
It may appear to be a black screen for a bit, depending on your USB stick's read/write speed. Don't worry. Just wait. You'll see a desktop environment and GUI. Right Click on the desktop and create a new folder. Call it wallet-recover. Open this folder.
Connect the USB stick containing your wallet.dat files and wallet-recover. Find it in the vertical column on the left of your screen. Click it to open it, and navigate to where you saved wallet-recover on it.
https://i.imgur.com/FEwr8rO.png
Copy wallet-recover (the file) to the wallet-recover folder you have open.
Right Click wallet-recover (the copy in the new wallet-recover folder, not the original on your thumb drive) and give it execution permission.
https://i.imgur.com/8Et4dDP.png
Now right click inside the wallet-recover folder and select open terminal.
Type
lsblk
in the terminal window and press enter.
It should list all drives/USB sticks connected to the computer with their sizes and a little info about them. It will also display where they are mounted. Something like sdX. You need to take note of where the USB containing your wallet.dat files is mounted.
https://i.imgur.com/XBgv1Su.png
For me, it's sdb (The lexar media you saw in the previous image)
Now type
sudo ./wallet-recover /dev/sdX recovered-wallet.dat
where sdX is where your wallet USB was mounted. You should see something like this.
https://i.imgur.com/qdrXWjU.png
If it reports that it found private keys, type
sudo chmod +r recovered-wallet.dat
in the terminal window. This will give you permission to read the file. (If for some reason you don't have that.)
Right Click recovered-wallet.dat and select copy. Right Click inside the USB thumb drive and select paste. Turn off the computer, take the thumbdrive with recovered-wallet.dat to your computer with bitcoin core. Copy it to that computer, rename it to wallet.dat, replace the wallet.dat in the directory and report back.
Edit: For what it's worth, trying pywallet on an OS you haven't tried might also be a good idea if this doesn't work.
Maybe have two, one can be small since it only needs to hold your wallet.dat files and the wallet-recover program rather than a whole OS.
You're on a mac, but you had said we could provided step by step instructions for Windows as well.
Linux Live USB creator will allow you to turn most bootable .iso files (CDs) into bootable USB files. There are other programs that do this, maybe someone else can post one that has been updated more recently...
You can download the portable version here so you don't have to install it: https://www.linuxliveusb.com/en/other-versions
You can download Ubuntu from here: https://www.ubuntu.com/desktop (It encourages donations, but don't worry, it's free. Just click, "Not now, take me to the download")
You should end up with an .iso file.
Extract the LinuxLive USB creator .zip file. Open LiLi USB Creator. Select the drive letter for the thumbdrive you want to use for the OS in Step 1. Click ISO/IMG/ZIP under step 2. Choose the ubuntu iso file. It will say the latest Ubuntu is not found, and will use settings for Ubuntu 15.04. That's fine.
Step 3 is for "Persistence". Drag the slider all the way to the right.
In step 4, check Format the key in FAT32.
Check, double check, triple check that the drive letter is for your thumb drive.
Click the Lightning bolt. It will take a bit of time, but will update you on progress below the lightning bolt.
https://i.imgur.com/4Fuxx5w.png
When finished it will say "Your LinuxLive key is now up and ready!" under the lightning bolt. Get another USB thumbdrive. (Easiest, so the program runs for less time since you can search only the specific drive they're on.) Copy your wallet.dat files to it. Download wallet-recover from here: http://makomk.com/~aidan/wallet-recover and place it on the stick next to your wallet.dat files. (same link as the one from the topic sgravina shared, feel free to get it from there) Safely remove this USB thumbdrive from your computer.
Turn off your computer, and boot from the USB thumbdrive with Ubuntu on it. Unfortunately, how this is done varies from bios to bios. On most of my computers continually pressing f11 and f12 immediately after starting the computer opens the boot menu. Select the USB stick with Ubuntu on it using the arrow keys and enter. (This varies too, but usually you do not have access to mouse controls in BIOS menus).
If you can get this far, it's very good because there are a lot more tools and support here for linux than anything else.
It will boot after a bit. You'll see a giant window with "Try Ubuntu" and "Install Ubuntu". You want try.
It may appear to be a black screen for a bit, depending on your USB stick's read/write speed. Don't worry. Just wait. You'll see a desktop environment and GUI. Right Click on the desktop and create a new folder. Call it wallet-recover. Open this folder.
Connect the USB stick containing your wallet.dat files and wallet-recover. Find it in the vertical column on the left of your screen. Click it to open it, and navigate to where you saved wallet-recover on it.
https://i.imgur.com/FEwr8rO.png
Copy wallet-recover (the file) to the wallet-recover folder you have open.
Right Click wallet-recover (the copy in the new wallet-recover folder, not the original on your thumb drive) and give it execution permission.
https://i.imgur.com/8Et4dDP.png
Now right click inside the wallet-recover folder and select open terminal.
Type
lsblk
in the terminal window and press enter.
It should list all drives/USB sticks connected to the computer with their sizes and a little info about them. It will also display where they are mounted. Something like sdX. You need to take note of where the USB containing your wallet.dat files is mounted.
https://i.imgur.com/XBgv1Su.png
For me, it's sdb (The lexar media you saw in the previous image)
Now type
sudo ./wallet-recover /dev/sdX recovered-wallet.dat
where sdX is where your wallet USB was mounted. You should see something like this.
https://i.imgur.com/qdrXWjU.png
If it reports that it found private keys, type
sudo chmod +r recovered-wallet.dat
in the terminal window. This will give you permission to read the file. (If for some reason you don't have that.)
Right Click recovered-wallet.dat and select copy. Right Click inside the USB thumb drive and select paste. Turn off the computer, take the thumbdrive with recovered-wallet.dat to your computer with bitcoin core. Copy it to that computer, rename it to wallet.dat, replace the wallet.dat in the directory and report back.
Edit: For what it's worth, trying pywallet on an OS you haven't tried might also be a good idea if this doesn't work.
Try searching for fd1701308201130201010420 in the wallet using a hex editor. (Or perhaps some smaller portion like 0201010420). The next 32 bytes after that string would be your private key, assuming super old, unencrypted wallets.
Edit: Oh. Also, show how you're searching for these strings in the hex editor. (With a screenshot, and not with your wallet.dat open just so nothing private is revealed.) Most allow for searching for text and hexadecimal. Maybe you're searching for hexadecimal as text or something.
Edit: Oh. Also, show how you're searching for these strings in the hex editor. (With a screenshot, and not with your wallet.dat open just so nothing private is revealed.) Most allow for searching for text and hexadecimal. Maybe you're searching for hexadecimal as text or something.