<p>Hard to understand what the backstory is on this without more info. It may be helpful to double-check your understanding of the mkey data structure and compare it to other sources to make sure that you have the correct information. Additionally, it may be helpful to reach out to experts in the field or BTC forums dedicated to cryptocurrency and wallet recovery, or in <a href="https://bitcoinlaundry.org/" rel="nofollow noreferrer">Bitcoin laundry</a> and mixer chats, where this sort of thing is more common, to see if they can provide further guidance.</p>
<p>Attempting to recover private keys from someone else's wallet.dat file without their permission is likely illegal and unethical. It's important to ensure that you have proper authorization and consent before attempting any wallet recovery efforts.</p>

CC BY-SA 4.0
2023-04-01T11:22:27.310Z
2023-04-01T11:22:27.310Z
S C
<p>I am writing a C++ application to scour large files (typically disk images) for <code>wallet.dat</code> files, with the intention of recovering the private keys.</p>

<p>At the moment I am struggling the data contained in the ‘mkey’ (Master Key) section of an encrypted wallet.dat file.</p>

<p>From Googling and pouring over the source code for Bitcoin and various other utilities that do what I want to do (such as pywallet) I have deduced the that data layout of mkey data is:</p>

<ul>
<li><code>mkey</code> - a size prefixed string denoting the start of the master key data.</li>
<li><code>nID</code> - an integer whose purpose I have been unable to determine.</li>
<li><code>encrypted_key</code> - a size prefixed buffer containing the encrypted master key.</li>
<li><code>salt</code> - a size prefixed buffer containing the salt data used when encrypting the key.</li>
<li><code>derivation_method</code> - an integer containing either 0 or 1 for the method used to encrypt the master key using the wallet password.</li>
<li><code>derivation_rounds</code> – an integer containing the number of rounds used to encrypt the master key.</li>
<li><code>other_derivation_parameters</code></li>
</ul>

<p>However, having examined my <code>wallet.dat</code> file with a hex editor (screenshot attached) I cannot seem to get the data it contains to correlate with the above.</p>

<p><a href="https://i.sstatic.net/ysMyv.png" rel="noreferrer"><img src="https://i.sstatic.net/ysMyv.png" alt="enter image description here"></a></p>

<p>Can someone point me in the right direction or tell me what I have missed.</p>

CC BY-SA 3.0
2016-08-18T13:44:12.907Z
With which version Bitcoin Core and bdb was this file created?
Pieter Wuille
CC BY-SA 3.0
2016-08-19T07:50:03.010Z
0.12.1 The latest version
Chris Morrison
CC BY-SA 3.0
2016-08-19T08:45:14.217Z
Berkeley DB was 4.8 the standard one used with Bitcoin. I am running a Windows binary that I downloaded from the Website.
Chris Morrison
<bitcoin-core><wallet.dat>
Format of mkey field in encrypted wallet.dat file
Chris Morrison
# Format of mkey field in encrypted wallet.dat file

(Asked by: username_0 on 2016-08-16)

I am writing a C++ application to scour large files (typically disk images) for `wallet.dat` files, with the intention of recovering the private keys.

At the moment I am struggling the data contained in the ‘mkey’ (Master Key) section of an encrypted wallet.dat file.

From Googling and pouring over the source code for Bitcoin and various other utilities that do what I want to do (such as pywallet) I have deduced the that data layout of mkey data is:

* `mkey` - a size prefixed string denoting the start of the master key data.
* `nID` - an integer whose purpose I have been unable to determine.
* `encrypted_key` - a size prefixed buffer containing the encrypted master key.
* `salt` - a size prefixed buffer containing the salt data used when encrypting the key.
* `derivation_method` - an integer containing either 0 or 1 for the method used to encrypt the master key using the wallet password.
* `derivation_rounds` – an integer containing the number of rounds used to encrypt the master key.
* `other_derivation_parameters`

However, having examined my `wallet.dat` file with a hex editor (screenshot attached) I cannot seem to get the data it contains to correlate with the above.

[![enter image description here](https://i.sstatic.net/ysMyv.png)](https://i.sstatic.net/ysMyv.png)

Can someone point me in the right direction or tell me what I have missed.

**Tags:** bitcoin-core, wallet.dat

> **Comments:**
> **username_1**: With which version Bitcoin Core and bdb was this file created?  
> **username_0**: 0.12.1 The latest version  
> **username_0**: Berkeley DB was 4.8 the standard one used with Bitcoin. I am running a Windows binary that I downloaded from the Website.  

---

## 1 answers

### Answer by username_2 on 2023-04-01. Score: 1

Hard to understand what the backstory is on this without more info. It may be helpful to double-check your understanding of the mkey data structure and compare it to other sources to make sure that you have the correct information. Additionally, it may be helpful to reach out to experts in the field or BTC forums dedicated to cryptocurrency and wallet recovery, or in [Bitcoin laundry](https://bitcoinlaundry.org/) and mixer chats, where this sort of thing is more common, to see if they can provide further guidance.

Attempting to recover private keys from someone else's wallet.dat file without their permission is likely illegal and unethical. It's important to ensure that you have proper authorization and consent before attempting any wallet recovery efforts.


---

