Quote from: Pamoldar on February 10, 2019, 07:28:11 PM

Quote from: umadbro on February 10, 2019, 06:34:28 PM

1. What type of currency are you hoping to recover and how much?

2. What software was used to create and encrypt the wallet?

3. What type of device was used (mobile, pc, hardware wallet, etc) to create the wallet and what operating system does the device run if applicable?

4. Do you have access to a pc? Is it a desktop or a laptop? What operating system does the machine run?

5. Approximately when was the wallet created? When was the encryption applied? When was the last time you had access to the wallet?

6. Can you describe the process you're using to attempt to decrypt the wallet? What sort of backup information are you in possession of? Is it a backup file? A pass phrase/recovery seed?
**Please see the advisory below before posting your answer to this question.**

7. This question is more relevant in a non test scenario but could still be helpful:
Can you tell me a little bit about what happened? How did you lose access to the wallet? Is this your personal wallet or are you inquiring on behalf of a third party? Do you have any proof that you had access to the wallet at some point in the past?

ADVISORY: I don't recommend posting any portion of your private keys, backup file, pass phrases or passwords at this time as it could lead to a compromise of your wallet.

Thanks again for your time. I'm looking forward to the followup.

1. Bitcoin. There are no balance I just want to see if you can recover it.
2. Electrum
3. Laptop. Windows 10
4. Yes. Laptop. Windows 10
5. Not create yet (LOL). Not yet. Not yet (I will create one once you will ask)
6. (Assume I lost all of them) I do not have the backup file, no recovery phrase
7. ....

Let me know what else I will need to provide.

(I know this is a test but let's act as if this is a real situation where you might have some knowledge about the password here.)

First, what do you know about the password? What do you think you might've set it to? Can you provide some other passwords you would typically use at the time you created this wallet? Do you know if it was less than a certain number of characters? Do you typically mutate your passwords in a certain way such as adding an exclamation point to the end of a word, replacing your A's with 4's or starting with a capital letter and ending with a number? The more possible passwords you can provide the better. Just make sure you don't still use these passwords today.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Next we'll need to extract the hash from the wallet file. This may be a slightly difficult process if you're not familiar with using the windows command line. I'd be happy to provide live remote assistance if required, just contact me on the telegram handle I listed above. Forgive me for any typos or if this is confusing, I just typed it up on the fly here as quickly as I could but I'm working on a guide with screenshots for the website.

Here's what you're going to need to do:

PART 1:

If you already have python 2 installed you can skip part 1.

You're going to need to install python. Here's a link to the installer for windows on the official python site.
EDIT: The forum won't let me link to the python installer so just follow the link in the directions below, it's safe.

Here is a decent guide for installing python:
https://www.howtogeek.com/197947/how-to-install-python-on-windows/ - This page has instructions for python version 2 and 3. You'll be installing python2
Make sure you follow the instructions to "add python.exe to path".

PART 2:

Next you'll need to acquire the script to extract the hash from the wallet file. This can be found here:
https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/electrum2john.py
If the page opens as a text view rather than giving you a download dialog press ctrl+s to save it. Make sure to remember where you save this. I'd recommend your desktop or documents folder, somewhere easy to navigate but not accessible by anyone else who uses the machine or being synced to any cloud storage.

PART 3:

Disconnect your machine from the internet. This is not required but recommended for security.

Close electrum completely.

Locate the wallet file. On windows, this can be found by navigating to your app data folder. A quick way to access this location is to close or minimize all open windows, hold the windows key down on your keyboard and press the R key to open a run dialog. Paste this string without the quotes into the dialog and press enter: "%APPDATA%\Electrum\wallets".

Alternatively you can open the file browser, navigate to your system drive (typically c:). You'll need to configure the file explorer to allow hidden and system files to be shown. Instructions to do this can be found here:

https://support.microsoft.com/en-us/help/4028316/windows-view-hidden-files-and-folders-in-windows-10

Once hidden and system files are being shown, navigate to your system drive, then go to the Users folder. There will be a folder with your username, navigate there next. Next you'll navigate to the AppData folder, it'll appear slightly opaque. Once in the appdata folder, navigate to Roaming, then the Electrum folder, then finally the Wallets folder. The file you're looking for in the folder will most likely be titled "default_wallet". If there are additional wallet files in this folder copy them as well in the next step.

Copy and paste (NOT CUT AND PASTE) all wallet files to the same location as the script you downloaded in part 2. Again, you'll want to make sure the copy is in a secure location not being synced to cloud storage or accessible by anyone else who might use the machine. Treat this file as you would your banking information.

Part 4:

Open the windows command prompt. An easy way to do this is to open the run dialog (windows key + r), type "cmd" without quotes and press enter.

Alternatively you can click start, type cmd and select the option for the command prompt.

Next you'll navigate to the location you save the wallet file and the extraction script.
When you open the command prompt you'll usually start in your profile directory. If you saved the files to your desktop type "cd desktop" or "cd documents" for the documents folder without quotes and press enter.

To extract the actual hash type the following, again without quotes:
"python electrum2john.py default_wallet"
This will output a long string of letters and numbers that should start with something like this:

default_wallet:$electrum$3*037868c77f730f0b8e702

Copy and paste this string to a text file or directly into your response here in the thread. This string does not give access to your funds or reveal any information about your wallet.
If your wallet had a different filename just replace default_wallet with that name. Repeat this process on any other encrypted wallet files you located in step 3.

You can now delete these copies of the wallet files just make sure you made copies rather than moving them. Personally, I would move them to a flash drive for safe keeping.

---------------------------------------------------------------------------------------------------------------------------

And that's it! I know it's a bit of a cumbersome process but it's best for your security to use these publicly available tools rather than a script provided by me or someone else who you don't know. Once my service is a bit more trusted here I'll create tools to make this easier. Again, sorry for any mistakes in my guide. The wife wants to go shopping and i'm trying to be quick so I can watch the baby

. If you come across any problems in the process be sure to report any error messages you encounter.

umadbro

Posts

Merits