Hi there everyone.

Firstly, my disclaimer, I am not an expert, I am a person who works in IT who is trying to help a friend who is into Crypto. So forgive me if I get some of the language mixed up... I will do my best to relay everything.

I have a friend (we can call him Jay) who has some old wallet.dat files from his various years of working with crypto. He decided to look at some old hard drives that he had, and look to see what he could recover after formatting them some years back. Using Recuva, he found a few wallet.dat files, along with their associated addresses. Given that they were recovered, we are not sure of the state of the wallets. He has said that because he has worked with so many platforms across the years, he is not sure exactly which platform he was working with when exporting the .dat files, but he believes these were Bitcoin Core.

He was initially involved in BTC Mining right in the beginning, when you could still use memory sticks to mine coins and you received a 50BTC reward for working on the mining...

One of the wallets is from these initial mining efforts, but from what he has said, it seems that the one .dat file is a deterministic wallet that's also linked to three other addresses. So let's call this one Wallet 1 (I think he called one of the addresses an origin wallet or a genesis wallet or something along those lines). When examining the primary address, we can see the block reward from 2009 and a few other transactions, but none outgoing for several years. (I am not sure how deterministic wallets are different from regular ones, so I don't know if this makes a difference to another wallet.dat file)

There is another wallet, Wallet 2, which also has its own wallet.dat file. This one first received and then performed a few transactions in 2010, but still holds its contents as well.

Wallet1 is 67kb. Wallet2 is 62kb. When opening these wallets in a notepad, we can see ckey values.
This is a sample of Wallet 1's format in Notepad:
https://imgur.com/a/4bvrUVx
Wallet 1 is 66537 characters in Notepad, and has 205 sets of data.
This is a sample of Wallet 2's format in Notepad:
https://imgur.com/a/z9iOGFy
Wallet 2 is 65388 characters in Notepad, and has 202 sets of data.

When attempting to open Wallet1 and Wallet2 in the most up-to-date version (27.0) of Bitcoin Core, we get this:
https://imgur.com/a/a3kc3Bp

It is, however, my understanding that some of the oldest wallets may be incompatible with the newer BTC Core installation.

There is another wallet.dat file (136kb), Wallet3, which is associated with an address which was created in 2013. This one is different from the first two, insofar as the format in Notepad is vastly different, and opening it in Notepad just presents 139 261 characters of gibberish. We (another friend of mine, Kay, who is more competent in python that I am, and I) believe it's been double encrypted. Wallet 3 can open in Bitcoin Core, even though we receive a warning that it is a legacy wallet... but attempting a transaction prompts for a passphrase.

I have asked Jay if he doesn't have some way to check the restorations for any associated .json files which might have been associated with any of the wallets, and he is adamant that "Back then we literally just needed to save the .dat file to a memory stick for it to be considered as backed up"... He doesn't remember what he was using in 2013.

Kay and I have been working with as many online resources as possible, scouring forums and trying a multitude of methods for recovery, including Pywallet (in both Python 2.7 and 3. Cool

, BTCRecover, and Salvage commands. We have also been trying to extract WIF values from the ckey values in the .dat files to try and pull the wallets into Electrum, but the WIF values we are able to extract appear to be for the incorrect wallets, or our attempts return 51/52-character long values, which is not supported... We have tried hashcat, and have gone through over 25million password combinations, but none seem to be working. Sadly, because these are such old wallets, it would appear that resources which were available to recover them several years ago are either tricky to find or completely missing today.

So, a few questions:
1. Is there a way to verify that Wallet1 and Wallet2 are, in fact, viable? I don't know how to validate these wallets to be sure that they aren't corrupted, which could be (I would imagine) a valid reason for them failing.
2. If my understanding of the notepad values of W1 and W2 are correct, then each ckey value is a private key which has been compressed. As mentioned, I have tried to convert them into WIF formats to try and bring into Electrum... I am not sure if I am missing something. The last few weeks have seen us trying so many different theories, attempts etc, my head is a bit fuzzy with it all, so I apologize if I don't have exact references for everything. Please feel free to point me in the direction of tutorials if you are aware of any.

The next thing which I wanted to try was wallet-recover from makomk, as referenced here:
https://bitcointalk.org/index.php?topic=2668480.0
https://bitcointalk.org/index.php?topic=25091.0

Unfortunate I don't seem to be able to download the utility from the url in those posts (http://makomk.com/~aidan/wallet-recover), and going to makomk.com and searching for it returns no results. Is there a chance that someone has the url to be able to download this tool?

Any guidance would be truly appreciated.

Sincerely,
Angel

ShyAngel444

Posts

Merits