Need help recovering my bitcoins

1

2

A few years ago I purchased some bitcoins from MtGox and decided to retrieve them to the wallet on my PC.

Now without getting into detail I got sick of the headaches and ended up uninstalling the program before I received ANY coins. In retrospect I could not have been a bigger idiot.

Now these coins are worth a small fortune and I've done everything I could think of to retrieve them. I contacted MtGox and all they could say was that the network says the transaction shows as complete. I have extensively and on a byte level searched the PC in question for remnants of my private key, with no success.

Which brings me to the question at hand.

I still have my public key, the knowledge the coins were never received and access to the MtGox account they were sent from.

What can I do? MtGox simply left it at "the network says it was completed, therefore fuck off"

anonymous

Posted 2013-12-03T14:33:21.327

Reputation: 11

You're wrong, though; the coins were received. Mt.Gox sent them to your address, and that transaction was written into the blockchain. Even if they wanted to, Mt.Gox couldn't get them back without the private key of your wallet. – NReilingh – 2014-01-02T20:55:44.130

Answers

2

First step: stop using that harddisk absolutely immediately. Either get a new one and start using that or make a complete image on the byte level (for example with dd in linux). Any write action you do on your current disk may overwrite your private key (assuming it hasn't already).

For further steps you need to provide more info.

Which bitcoin wallet were you using?

Was your wallet encrypted with a password, do you remember?

Jannes

Posted 2013-12-03T14:33:21.327

Reputation: 5 823

I'm not sure, I think bitcoin QT. Whatever was the most common bitcoin wallet in 2011. – anonymous – 2013-12-03T18:19:50.787

Sorry, took too long to edit. As I said I just picked the most basic one of the bunch for the time. The whole OS was stored in an encrypted container stored on a regular HDD that I continued using for a while.

I searched the whole disk for terms like "bitcoin", "wallet", etc. but couldn't even locate an empty folder or traces of the program. I mainly focused on bitcoin-QT and multibit recovery. I ran pywallet too with no success.

The wallet MAY be encrypted, but probably isn't. How would this affect recovery?

And mainly, what are my options if physical recovery fails? – anonymous – 2013-12-03T18:30:07.263

The OS was on an encrypted container? That could complicate things. How is it encrypted? Here's a utility that scans a storage device for deleted wallet data. I'm not sure, but it might be possible to pipe in a decoded image of your drive: https://bitcointalk.org/index.php?topic=25091.0 At any rate, the first step is to recover the wallet.dat file (or whatever portion you can). If the file was itself specifically encrypted (via the basic client), then some bruteforcing can be done if you used a simple password.

– Mike Asdf – 2013-12-03T20:06:49.500

Does that container still exist and can you open it? If so, you should make an image of that contents (non-encrypted). If not, I guess you're out of luck. – Jannes – 2013-12-03T20:23:14.010

It sounds like you've been using filesystem-level recovery tools. Those need the basic structure of a filesystem intact (directory and filesnames) and the basic structure of the database (wallet) file (Berkeley DB) intact. A last resort would be getting the first x bytes the partition and then trying to see if it's a valid key. If not, move to the next byte and try that. Until the end. (Maybe the tool @MikeF pointed to does that, not sure) This is why I asked whether the wallet is encrypted, because then even that wouldn't work anymore. – Jannes – 2013-12-03T20:34:58.000

Thank you Mike F, I'll give physical recovery another shot using that tool. However as I said I've done a lot of searching already and it's not looking good. Jannes, I can easily decrypt the container. I shouldn't need to bruteforce the password to my wallet either. Could any of you tell me how to recover my private key if I used a program other than bitcoin-QT? Considering it was a wallet program dated 2011 there can't be that many options. What else is there? What if I'm not looking for wallet.dat? And what if I really can't recover my private key, are there ANY other options? – anonymous – 2013-12-03T23:37:42.377

If it was that far back, I can hardly imagine someone using any other wallet program. The private key is mandatory; all bitcoin transactions require the private key(s) of the source funds in order to sign the transaction and make it valid. – Mike Asdf – 2013-12-04T07:47:41.440

The tool that Mike F pointed to will do the low-level scan for specific bytes that I mentioned. I looked in the source code a bit and it scans for certain byte patterns that are expected to surround the private keys. It does not really look for a wallet.dat file, it just looks for the bytes it needs. So just make sure that you point that tool to the UNencrypted (copy of the) container. That really is your last hope as far as I can think of. – Jannes – 2013-12-04T10:20:51.130

I seem to be having a problem while using the tool Mike F talked about: https://bitcointalk.org/index.php?topic=25091.0 I downloaded and burned system rescue cd and booted my computer from it. Downloaded the tool, unpacked it and.. Well, then this happens: https://bitcointalk.org/index.php?topic=25091.msg1513140#msg1513140 nobody has answered that guy either.. What do I do?

– anonymous – 2013-12-07T18:50:08.523

I've never used System Recovery Tools before until I tested it just now, but assuming you're using its default command-line, then apparently you're already logged in as root. In which case you can omit the word "sudo" from the command. – Mike Asdf – 2013-12-09T20:15:49.407

In case Jannes and I weren't clear enough: make sure you pass the unencrypted, uncompressed image to the tool, not the default /dev/sda. i.e. your command will be something like: ./wallet-recover-0.3-linux/bin/32/wallet-recover /mnt/someDriveOrNetworkPath/DecryptedDriveImage.bin recovered-wallet.dat – Mike Asdf – 2013-12-09T20:17:29.180

Asked: 2013-12-03T14:33:21.327

Viewed: 756 times

Active: 2019-11-03T16:21:36.957