<p>It has magic bytes plus a version number at byte 12 in the file:</p>

<pre><code>00000000 [00 00 00 00 01 00 00 00] [00 00 00 00] [62 31 05 00]
                     ^ lsn               ^ page num    ^ magic
00000010 [09 00 00 00] [00 20 00 00] 00 [09] 00 00 00 00 00 00
               ^ version     ^ page size  ^ db type
</code></pre>

<p>Searching for <code>62 31 05 00 09 00 00 00</code> should get you what you're looking for.</p>

<p>Source: berkleydb source code: <a href="http://www.gnu.org/software/mifluz/doc/doxydoc/db__page_8h-source.html#l00078" rel="noreferrer">layout</a>, <a href="http://www.gnu.org/software/mifluz/doc/doxydoc/db_8h-source.html#l00459" rel="noreferrer">magic number</a></p>

<p>If that doesn't work, there are a couple of patterns you might find handy:</p>

<ul>
<li><p><code>00 01 07 6b 65 79 6d 65 74 61</code> (keymeta)</p></li>
<li><p><code>00 01 0a 64 65 66 61 75 6c 74 6b 65 79</code> (defaultkey)</p></li>
<li><p><code>00 01 0a 6d 69 6e 76 65 72 73 69 6f 6e</code> (minversion)</p></li>
<li><p><code>00 01 09 62 65 73 74 62 6c 6f 63 6b</code> (bestblock)</p></li>
<li><p><code>00 01 03 61 63 63</code> (acc) Account</p></li>
<li><p><code>00 01 03 6b 65 79</code> (key)</p></li>
<li><p><code>00 01 04 63 6b 65 79</code> (ckey) Encrypted key</p></li>
<li><p><code>00 01 04 6d 6b 65 79</code> (mkey) (Only in encrypted wallets)</p></li>
<li><p><code>00 01 04 6e 61 6d 65</code> (name)</p></li>
<li><p><code>00 01 07 70 75 72 70 6f 73 65</code> (purpose)</p></li>
</ul>

<p>There's a list of the tokens it uses <a href="https://github.com/bitcoin/bitcoin/blob/48b5b84ee511d5ccd0d47bb0018c1b3c9ddebeff/src/wallet/walletdb.cpp#L73" rel="noreferrer">in this source file</a>, and you can see an explanation of what they correspond to <a href="https://bitcoin.stackexchange.com/questions/3173/what-information-does-a-wallet-contain/3177#3177">here</a>.</p>

CC BY-SA 3.0
2015-11-20T22:50:11.297Z
2017-07-26T18:06:48.097Z
2017-07-26T18:06:48.097Z
Nick ODell
<p>A customer of mine brought me a 2TB crashed harddrive. The drive itself is not damaged physically, but the file tables (MFT / NTFS) are corrupt so there is zero ability to recover files with their original names.</p>

<p>The contents of the drive is not important, except for the customer's wallet.dat file which contains "a substantial amount of bitcoins" (sic).</p>

<p>Finding this file among 2TB of data is pretty much a needle in a haystack.</p>

<p>So, question: Does wallet.dat contain anything unique, anything that can be binary searched for, anything that makes it say "hey, I'm wallet.dat!"?</p>

CC BY-SA 3.0
2015-11-21T12:51:45.337Z
Note that there are some open source wallet recovery told out there that might help find out salvage it. I don't have experience with them though, so you'd have to try.
Jannes
<wallet.dat>
Filesystem is corrupt. How to find wallet.dat?
bos
# Filesystem is corrupt. How to find wallet.dat?

(Asked by: username_0 on 2015-11-20)

A customer of mine brought me a 2TB crashed harddrive. The drive itself is not damaged physically, but the file tables (MFT / NTFS) are corrupt so there is zero ability to recover files with their original names.

The contents of the drive is not important, except for the customer's wallet.dat file which contains "a substantial amount of bitcoins" (sic).

Finding this file among 2TB of data is pretty much a needle in a haystack.

So, question: Does wallet.dat contain anything unique, anything that can be binary searched for, anything that makes it say "hey, I'm wallet.dat!"?

**Tags:** wallet.dat

> **Comments:**
> **username_1**: Note that there are some open source wallet recovery told out there that might help find out salvage it. I don't have experience with them though, so you'd have to try.  

---

## 1 answers

### Answer by username_2 on 2015-11-20. Score: 17 | Accepted answer

It has magic bytes plus a version number at byte 12 in the file:

```
00000000 [00 00 00 00 01 00 00 00] [00 00 00 00] [62 31 05 00]
                     ^ lsn               ^ page num    ^ magic
00000010 [09 00 00 00] [00 20 00 00] 00 [09] 00 00 00 00 00 00
               ^ version     ^ page size  ^ db type

```

Searching for `62 31 05 00 09 00 00 00` should get you what you're looking for.

Source: berkleydb source code: [layout](http://www.gnu.org/software/mifluz/doc/doxydoc/db__page_8h-source.html#l00078), [magic number](http://www.gnu.org/software/mifluz/doc/doxydoc/db_8h-source.html#l00459)

If that doesn't work, there are a couple of patterns you might find handy:

* `00 01 07 6b 65 79 6d 65 74 61` (keymeta)
* `00 01 0a 64 65 66 61 75 6c 74 6b 65 79` (defaultkey)
* `00 01 0a 6d 69 6e 76 65 72 73 69 6f 6e` (minversion)
* `00 01 09 62 65 73 74 62 6c 6f 63 6b` (bestblock)
* `00 01 03 61 63 63` (acc) Account
* `00 01 03 6b 65 79` (key)
* `00 01 04 63 6b 65 79` (ckey) Encrypted key
* `00 01 04 6d 6b 65 79` (mkey) (Only in encrypted wallets)
* `00 01 04 6e 61 6d 65` (name)
* `00 01 07 70 75 72 70 6f 73 65` (purpose)

There's a list of the tokens it uses [in this source file](https://github.com/bitcoin/bitcoin/blob/48b5b84ee511d5ccd0d47bb0018c1b3c9ddebeff/src/wallet/walletdb.cpp#L73), and you can see an explanation of what they correspond to [here](https://bitcoin.stackexchange.com/questions/3173/what-information-does-a-wallet-contain/3177#3177).


---

