Quote from: NotATether on Today at 11:40:41 AM

Quote from: furyo87 on September 03, 2017, 12:19:39 AM

INFO "Filename: 49C7D454d01 Path: D:\?
Size: 30.6 KB (31,348)
State: Very poor
Creation time: 1/31/2010 19:59
Last modification time: 1/31/2010 19:59
Last access time: 1/31/2010 19:59
Comment: This file is overwritten with "D:\Programas\Mozilla Firefox\chrome\pippki.jar.moz-backup"
6 file cluster(s) overwritten (0, 1, 2, 3, 4, 5)
4 cluster(s) allocated at offset 6301398 4 cluster(s) allocated at offset 6305132"

Your wallet file has the first 6 of its 8 sectors overwritten by some Firefox file, and not Recuva, which amounts to the first 24KB of the 30.6KB gone from your hard disk. It is highly likely the Berkeley DB table that holds the private keys was at the beginning of the file and therefore overwritten. Unless you have clones from before the time you installed Firefox, your odds of recovery are low. I'm not sure if even a recovery service can help you here since the sector data was overwritten.

Thank you Sir!
I agree with it being overwritten with Firefox! Recuva is just the recovery software I was dumb enough to use without having cloned the HD beforehand. (don't judge too much installing Firefox... it was all the rage back then).
This certainly lowers the Chance of Success and increases a bit the frustration - it really seems that it is close. How I wish the private keys were at those last 6 KB!

If you were in my shoes, do you think considering professional data recovery service would be an option? I read somewhere that sometimes it is possible to infer underlaying data after being overwritten (it sure beats my simple brain model of a hard drive where you have either a 0 or a 1 recorded in a magnetic plate). If going for that would you still Clone beforehand or just don't touch it any more?

Cheers

furyo87

Posts

Merits