Hey folks
So I managed to recover my old HDD and found this wallet.dat file from 2010. It shouldn't be encrypted, but I ended up deleting it because I totally forgot I mined some BTC back in the day.
After two years, I got the chance to get my wallet back. But before that, I installed Bitcoin Core on the same drive, downloading the blockchain onto a separate one. Now when I check the properties, it shows a creation date of 2021 and a modification date of 2010.
Could it be that the file got overwritten? I actually opened it as a text file before recovery, and it was readable under the name wallet.old. Also, I vaguely remember having a piece of paper with a few words and my private key written on it... but I tossed it because I had no clue it was important. There were four words on that paper. Is there a chance that I stumbled upon an encrypted wallet? Can I possibly decrypt it with those four words? Or did they even use a four-word passphrase back then? Any pointers on where to find more info about Bitcoin from 2009-2010 would also be super helpful.
Thanks!
If your wallet.dat isn't encrypted, you don't need any words to access it.
You're saying that Bitcoin Core (new version) created this file "wallet.old" when you attempted to view your wallet?
So you got an old HDD working... and then deleted your old wallet.dat?
Then you managed to recover the deleted wallet.dat... but before you recovered that deleted file, you had already installed Bitcoin Core and run it?
I'm a bit confused by what you've done... and what you actually have now... do you have TWO wallet.dat's? one from the recent install where you had the blockchain on the different drive... and the old "recovered" wallet.dat... or you do just have one wallet.dat?
Possibly either the passphrase for the Bitcoin wallet, but unlikely as encryption was added in September 2012 with version 0.4.0: https://bitcoin.org/en/release/v0.4.0 and you say your wallet was from 2010... or the 4 words could also have been a "brain wallet" used to generate the private key that was also written on the paper...
In either case, it's relatively moot, as you threw the piece of paper away
exactly... Shut down your system right away, remove the HDD from your system and use a tool like dd to clone your disk without mounting it first... The longer you keep using the disk, the less chance you'll have recovering anything. Maybe you won't need the clone, but it's better to be safe than sorry!
I don't think there were any brainwallets actually in use by people back then, I first heard of this term in late 2011: https://bitcointalk.org/index.php?topic=51397.0;all
Does anyone have the bitcoin wallet file from early 2010? I mined Bitcoin through the CPU in early 2010 but I ended up formatting the HD, recently I managed to find the HD and I'm trying to recover deleted file through Winhex, I would like to access a wallet from 2010 to know exactly the magic numbers in hex to find the private key. Please Help. I will give some bitcoins to whoever helps me. thanks
You can try using pywallet as described here: https://bitcointalk.org/index.php?topic=5161349.40
Or maybe this: https://bitcointalk.org/index.php?topic=25091.0
Take note that the wallet.dat file should be an intact-unloaded backup or newly created by those old versions.
An old backup that was loaded to some newer version could had been upgraded to that version's format.
(although nothing much have changed on an old/new legacy wallet's "magic numbers" appended to the private keys)
If you failed to get one, you can create it yourself:
Download the source from bitcoin core's github repo old archive here: https://github.com/bitcoin/bitcoin/tags?after=v0.2.11
Build it and create a wallet.
If you're unable to build it yourself, i have started this project: https://mocacinno.com/
v0.2.11 can be found on dockerhub and ghcr.io
docker pull ghcr.io/mocacinno/mocacinno/bitcoin_core_docker:v2.11
docker pull mocacinno/btc_core:v2.11
If you don't trust my images (you probably shouldn't trust anybody with money), you can find the dockerfile here: https://github.com/mocacinno/bitcoin_core_docker/blob/v2.11/Dockerfile
you can either build the image yourself, or at least verify the image built on ghcr.io was built with this exact dockerfile
There's some basic documentation on how to use these images here: https://mocacinno.com/userdocs/ (but it's a work in progress, the usecase of recovering an old wallet has not yet been posted... If you need help, i'll quickly do a writeup this week and update the documentation)
I formatted this hard drive at least twice and used it for a few years. I thought I had lost it, but when I moved I found it stored in a box.
I tried searching for the hex string "fd1701308201130201010420'', but no luck, I don't know if this prefix covers wallets from early 2010 or if all wallets contain the prefix 04 20 preceding a private key.
I hope that you're working on a disk image or restored backup of the drive instead of the original.
I have a for-test-only wallet.dat created with v0.1.3 and the consistent "magic number" before my private keys is: 0x01130201010420 but that wallet only has two keys.
Search for the famous 0x0201010420 if you need more result.
But that's a few months older than your target version;
however, as I've mentioned: there's nothing much changed in the magic number of old and some newer versions of legacy wallet.dat files.
Test wallet dump:
Some screenshots (same prvKey above):
1.
2.
That's a very helpful post, so please don't take my little nitpick the wrong way, but, the way you've written it looks to me like you might not realize that your test wallet actually does match the 12-byte pattern from the post that you're responding to (if you look carefully at your screenshots, then you'll see that your 7-byte pattern turns into the longer 12-byte one as you keep scanning left).
Formatting these days usually only means erasing old and writing new partitioning and filesystem data structures. In best cases it doesn't overwrite file contents, but file allocation is usually lost because filesystem structures are cleared and re-initialized as new.
With self-encrypting storage devices you can be less lucky, because if formatting the drive includes an erase (depends on the formatting software), you're out of luck. An erase of a self-encrypting device means, the device throws away the encryption key and this renders all sectors' content to bit garbage in fractions of a second.
TRIMming of SSDs is another challenge (mostly an obstacle) for data recovery as it highly depends on the storage device what kind of data is reported back for TRIMmed (marked as deleted) data sections. Most modern OSes use TRIM command when available for SSDs as it facilitates wear and garbage handling for the SSD controller.
But chances diminish when you say you used that drive after formatting. Using it means overwriting old content's sectors with new content which makes old overwritten content unrecoverable. It heavily depends how much new content was put on the drive after formatting.
And the ususal best practices when data recovery is performed: never work on the original data and storage media. Make a master forensic bit-by-bit copy, every sector of the source drive needs to be copied! If data content is really valuable, you make at least two redundant master copies.
From a master copy you make one or more working copies. You only work on the working copies!
Nitpicks are very much welcome specially those that can correct mistakes with good explanation. (I miss o_e_l_e_o)
As for your take on the context of my reply, perhaps because the matching pattern is not distinctly mentioned.
In this case, I think it's a per-person basis, additional context will be based on how they think individually.
This prefix is for unencrypted wallets.
Your wallet may be encrypted with a password, although I can't say for sure in which version the encryption feature appeared in the Bitcoin client.
Try looking for the wallet.dat header "006231050009" and the data after it.
I did some digging to answer that:
It's implemented in version 0.4.0, check the date here: https://github.com/bitcoin/bitcoin/tags?after=v0.5.0rc1
Here's the "readme" (release notes) at that time: https://github.com/bitcoin/bitcoin/blob/v0.4.0/doc/README#L28
The wallet encryption part isn't present in the previous release version 0.3.24.