How do I search for a hidden and disguised (extension changed) wallet file on damaged hard drive?

Back in 2012 we had a bitcoin or two on a computer that crashed. It was a dual boot system and the wallet was in the Linux partitions. The user, a family member, changed the file extension to a extension document, probably open office or abiword. I am trying to reconstruct the hard drive, and have recovered the files from the Linux partitions. I need to know how to search for and find the file now. I have been researching my butt off trying to find a reliable way to find it. The only computer I have right now is an old XP laptop with 512 megs of RAM, won’t have a newer computer for another 10-15 days (got an excellent dell direct deal but shipping and delivery is absurdly slow). I have done plenty of desktop support and home computer repair for a living, but have been retired since 2014 and my Data recovery experience is limited.

What I need most right now is a method to identify which among the hundred plus gigs of files is the wallet. First question is what is the minimum size of a wallet.dat file, so I can limit the time searches take by ignoring the zillions of files too small to be a wallet. I have seen one suggestion that new wallet files are about 96k.

Second question is how do I search for it? I need a search term, a unique string of text or characters that is present inside of every bitcoin wallet. And will Windows file manager find the text inside of the wallet, or will I need yet another tool? I have been using a string of numbers (62 31 05 00) that was suggested on a post here but have no idea how effective that might be.

Please note I have no Linux system or live cd for using Linux, and zero experience with Linux I don’t think this is the time for me to master the Linux command line, the potential for screwing up and destroying data is too high. I have imaged the Linux partitions from the old drive onto a 2 terabyte usb drive, and have recovered the files to that drive. Took me over a week. So the files are on a NTFS usb drive and should be safe to explore using Windows tools.

Any help will be greatly appreciated.

wallet

Kilroy

Posted 2018-01-30T19:08:50.290

Reputation: 1

Use the unix tool file to search for the magic number of the wallet.dat. Some shell script to loop over all files should have it in minutes if the filesystem hasn't been damaged. https://en.wikipedia.org/wiki/Magic_number_(programming)#Magic_numbers_in_files Edit: It will be much easier from a linux system. I wouldn't even dare to mount this disk in windows for being too afraid of windows overwriting some stuff on the linux filesystem.

– blues – 2018-01-30T19:58:58.663

I should have been more detailed in my original post regarding the tools I have available and my capabilities. I have no Linux system or live cd for using Linux, and zero experience with Linux I don’t think this is the time for me to master the Linux command line, the potential for screwing up and destroying data is too high. I have imaged the Linux partitions from the old drive onto a 2 terabyte usb drive, and have recovered the files to that drive. Took me over a week. So the files are on a NTFS usb drive and should be safe to explore using Windows tools. – Kilroy – 2018-01-30T20:35:20.313

2I'm voting to close this question as off-topic because this question is not bitcoin related. It is file system related, and having zero knowledge of Linux, and wanting to search from Windows goes far beyond scope of forum here. – pebwindkraft – 2018-02-01T22:57:28.887

I understand your confusion, but I am not asking for assistance in searching for the files. Or with Linux, as the files are on a NTFS volume on a usb external drive, attached to a Windows machine. The Linux info is useless to me, and bitcoin is not Linux only anyway. I still need keywords that only a bitcoin techie would know (or be able to find by opening a new and unused bitcoin wallet)), and what size a new bitcoin wallet from 2012 was. I have no idea why anyone wants to try to help me with using Windows or the Windows tools; I do not want or need that at all. – Kilroy – 2018-02-01T23:31:23.650

Answers

Try searching words fromaccount or timesmart. Wallet.dat is binary, so there should'nt be too many words accessible, but these should.

Denis Matafonov

Posted 2018-01-30T19:08:50.290

Reputation: 153

No luck. I may try downloading the bitcoin core from 2012 and opening the wallet that comes with it in notepad, that will show me what windows sees for code and other strings inside the wallet. Then search for some of those strings. And/or trying using Agent Ransack to search in Windows, as Windows explorer isn’t so hot. – Kilroy – 2018-01-31T20:11:55.773

Where this file is should be easy to find if it was only an extension rename.

If you recovered the directory structure also check the default Linux directory. ~/.bitcoin/

The original wallet.dat will be in the parent directory of the blockchain files seach for "blk00000.dat" to find that dir.

If just the extention was changed as you said, index the drive and search for wallet*.* using Windows explorer.

The wallet.dat file shouldn't be very large, only 1,390 kb for a wallet with 4 keys or so.

If the directory structure was lost and you have all these files in one directory. You can try to use Windows indexing further. Rename all the recovered files to have a .txt extention. From cmd window "ren *.* *.*.txt" that will preserve the old extention but also give it a .txt extention like "notepad.exe.txt" Then you can allow Windows to index all the content easily. And here's the gold. Search for "keymeta!" inside the files, your wallet.dat will have 100s of uses of this string.

Hope this helps. If you cash in share the wealth. Tips appreciated. :-) 13aRZ2u3Wzim5vjDpVaxQFP4v6ESn5hH5E

Evil Zymurgist

Posted 2018-01-30T19:08:50.290

Reputation: 115

I’m pretty sure the wallet file was moved, it certainly isn’t named wallet or .dat as the user was trying to hide it and renamed it. It’s only one bitcoin and in 2012 was not a big amount. But the “keymetal” is golden for me, and the size helps a lot too, as there’s a huge amount of files under 1,000 kb in over 450 gigs. Thank you very much! – Kilroy – 2018-02-02T00:07:34.380

I would definitely narrow the file size to search to 1k to 25k size. Also a lot of that file space may be the blockchain files, blk*.dat files of 131mb each in 2012 probably about 5g worth. Those could be moved out of the search. What ever you do, if you decide to bulk rename / delete etc. Back up first. – Evil Zymurgist – 2018-02-02T00:16:18.197

I’ve only been searching for files over 50k, I saw in my research that an empty wallet was over 96k. I will run those again to include 1k and larger. There were 10 bitcoins originally and even with only one left I have the impression that wallets get larger with every transaction so I will set the upper limit mit high. I usually start the searches just before bed as they are long and the computer doesn’t care if I am asleep. I am going to find that wallet! Thanks again. – Kilroy – 2018-02-02T00:51:44.833

@Kilroy indeed a wallet with a lot of transactions can get to a few mb. But a new wallet is only 1kb or so. – Evil Zymurgist – 2018-02-02T00:57:11.250