so, I'm looking into testdisk photorec.sig and I think wallet.dat is included. Here are some hex values I found:
dat 0 \x61\x15\x06\x00
dat 0 \x00\x06\x15\x61
dat 0 \x62\x31\x05\x00
dat 0 \x00\x05\x31\x62
dat 12 \x61\x15\x06\x00
dat 12 \x00\x06\x15\x61
dat 12 \x62\x31\x05\x00
dat 12 \x00\x05\x31\x62
dat 12 \x53\x22\x04\x00
dat 12 \x00\x04\x22\x53
dat 12 \x88\x09\x04\x00
dat 0 \x00\x04\x09\x88
I’m specifically trying to track down the Electrum wallet from 2013, which might have been called electrum.dat before switching to default_wallet. I’ve got some magic numbers below (don’t laugh) that I thought might be right:
elecwallet 0 "addr_history"
elecwallet 0 7B 0A 20 20 20 20 22 61 64 64 72 5F 68 69 73 74 6F 72 79 22 3A
elecwallet 0 0x22 0x61 0x64 0x64 0x72 0x5F 0x68 0x69 0x73 0x74 0x6F 0x72 0x79 0x22
Would these be right?
elecwallet 0 0x7B0A2020202022616464725F686973746F7279223A
elecwallet 0 "addr_history", 0x03
If it is, can someone smarter than me help with the right elecwallet file signature or magic number for my photrec.sig?
I promise a donation to anyone who can help me find my lost BTC.
I don't know about HEX representation, but i'm confident you can use "addr_history" to find file that supposed to be Electrum wallet file since it's one of JSON key string that saved by Electrum 1.6.1[1]. Electrum 1.6.1 is last version of Electrum that released in 2013[2].
P.S. You may want move your thread to Electrum sub-board[3], since this thread only talks about Electrum. You can do that by clicking "Move Topic" which can be located on bottom left of this thread.
[1] https://github.com/spesmilo/electrum/blob/1.6.1/lib/wallet.py#L1038-L1064
[2] https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES
[3] https://bitcointalk.org/index.php?board=98.0
The extension should be the same as bitcoin core's ".dat" since the default name is "electrum.dat" and can't be renamed within the client unless your backup was renamed.
The offset is good since you're searching from the first hex value.
The signature should be 0x7B27616464725F686973746F7279273A since those extra breakline and blankspaces could be "pretty format".
If not, you can also try: 0x7B0A2020202027616464725F686973746F7279273A
The difference here is you're looking for a value with single quotation marks (') instead of double (").
So, try:
or
Sample electrum.dat file contents: {'addr_history': {'1GWj....