Need Help with Bitcoin Wallet Retrieval from 2009-2010

Hey everyone, I finally managed to get my hands on 4 old hard drives from various family and personal computers that I used back in the day when I was involved with bitcoin. I don’t remember mining it myself, but I did receive some from users on a forum where I used to be an admin. Now I’m trying to access those and I’m feeling a bit lost. I’m almost sure there’s bitcoin hiding on these drives somewhere (hopefully not stuck on a website). I've been poking around here and also using ChatGPT, but I need step-by-step help. Any guidance would mean a lot. Just for context, I’m using a Macbook that’s online (let’s call it MacInt) and a brand new Macbook that’s never been connected to the internet (let's call it AirtightMac). I want to do all my recovery work on AirtightMac, which has an M2 Chip and is running macOS Sequoia 15.1. Here’s what I’ve done so far and I’d appreciate any advice on how to move forward or if I made any mistakes: - I connected each of the old hard drives one by one to r-studio on MacInt, created images, and restored all files to 2 different external hard drives. - On AirtightMac, I installed Python 3.9.13 since that was the earliest version I could get without Rosetta or an internet connection. - I successfully got PyWallet 2.6.1 running on AirtightMac after adding the Berkeley DB files and tweaking pywallet.py as needed. Took me like 10 hours since I’m a total newbie with Python.

If looking for the wallet.dat files logically isnt giving you any hits, maybe they were deleted? If so, you could search in the unallocated space for a specific header of the wallet.dat file this is the hex values for such a header: \x00\x05\x31\x62\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00 if you get any hits from searching the header, you need to go manually through each hit, and extract the area containing header start to what seems to be the end of the file. Im not familiar with a specific footer of the wallet.dat file. Good luck!

Thank you for the response! There is a good chance they might have been deleted since my account was deleted on the family computers at least in two different occasions. Do you have more intel on how to search for the hex values. This is all a foreign language to me as of now and ChatGPT has been my savior/guide thus far.

Im not sure with R-Studio it's been over 10 years since i last used it i think Im using X-Ways Forensics for stuff like this, and it would be able to search regex (grep) with just the line i showed you, and then i would only need to select if the search should apply to a search of the whole harddrive or a selected area (swap files/restore points/recycle bins/and unallocated area)

Thank you for this. It seems X-Ways Forensics does not run on mac but after a bit of research (read asking chatgpt haha) it seems I can use the .dsk image files of the original drive and search for the aforementioned Hex Headers using a grep or python script. I can also search through the recovered files using a hex editor. If i get any hits, then I guess I will see the next steps

Make sure you preserve the content of your old drives, never work on the original drive media! Make a forensic bit-by-bit copy of a drive (preferred is read-only mount of the original storage media, so to never alter the original source drive data content). Now you can put the drive in safe storage and don't need to touch or alter it. From your forensic drive image you can make a work copy which you mount for any recovery procedures. If you screw something up with your work drive image content, no problem, you have your unaltered forensic base drive image to start over again. Do this for every storage media you have where you want to try some recovery. Above procedure ensures that you don't accidently destroy data from your original storage media.

If I may add to my previous post about searching for a wallet.dat header in unallocated areas, I think you may actually be better off by removing a few hex bytes and edit that regular expression to be: \x00\x05\x31\x62\x00\x00\x00\x01 Using this should catch all variants of the wallet.dat header, sorry I didn't catch this in the first post.

Thank you for the replies. @Cricktor, I have used r-studio on MacOS to create byte-by-byte images of the drives then I proceeded to mount those and scan those to recover files. I was able to make pywallet work on my new airtight mac and ran all but one of the wallets through it with no success of it finding anything. Currently in the process of recovering files on my last harddrive image copy in hopes that something comes up. The wallet I'm searching for realistically was in a windows 7 account that was deleted and I'm hoping to recover that somehow but it seems that pywallet --recover is only helping but so much @bulleteyeddk I need to put that into chatgpt and figure out how to do that. that is my next step. is that a search i do on the .dsk image file or on the folders containing all the files? Thanks again guys!

Since you're searching for deleted files, you're best bet is to search in unallocated areas of the harddrive, I really can't remember if R-studio offer that kind of search, but as it's critical for you to find this, I would just search the whole harddrive, it takes a bit longer, but at least you know, you have been through the whole harddrive searching. With that specific regular expression we're trying to find the header of a wallet.dat file, if your search returns some hits, you need to figure out your self where that piece of file ends and export it as a wallet.dat file. As with deleted files, they can be somewhat overwritten by other data, as this area has been marked as empty for the operating system to write files. This is why it's so important not to use such a harddrive anymore, as data can be written just in the area where important data is stored.

It may be uncomfortable but when you accidently deleted some important files, it's not a bad idea to cut the power of the computer as quick as possible (no normal shutdown, I really mean to cut the power). On a desktop computer that's pretty easy: pull the power cord. Most laptops will hard cut the power when you press the power button for a few seconds (you will see the laptop turn off hard). Do not restart! Either boot from a removable media some suitable Linux OS with tools ready to image your storage device where you have deleted something and want to recover it. If you're not sure to be able to boot from your removable media (you may need to adjust boot sequence or boot into the boot media menu), it's maybe better to remove the storage media and image it first on another computer mounting it read-only. If your storage media is encrypted and tied e.g. to some secret keys in a TPM of your motherboard, then you're somewhat in trouble unless you have proper encryption recovery keys and such (Bitlocker encryption can hit you hard if you don't have the recovery key; again, make sure you have it if Bitlocker or other device encryption is enabled). This can damage the filesystem but it prevents that storage areas of deleted files get overwritten by some stuff that the computer will write sooner or later or which is written by the regular shutdown procedure. This is of course too late for you. I'm just mentioning it for others to keep in mind should a deletion mishap strike your fate. Wish you success with your recovery attempts.