<p>First step: stop using that harddisk absolutely immediately. Either get a new one and start using that or make a complete image on the byte level (for example with dd in linux). Any write action you do on your current disk may overwrite your private key (assuming it hasn't already).</p>

<p>For further steps you need to provide more info.</p>

<p>Which bitcoin wallet were you using?</p>

<p>Was your wallet encrypted with a password, do you remember?</p>

CC BY-SA 3.0
2013-12-03T18:19:50.787Z
I'm not sure, I think bitcoin QT. Whatever was the most common bitcoin wallet in 2011.
anonymous
CC BY-SA 3.0
2013-12-03T18:30:07.263Z
Sorry, took too long to edit. As I said I just picked the most basic one of the bunch for the time.
The whole OS was stored in an encrypted container stored on a regular HDD that I continued using for a while.

I searched the whole disk for terms like "bitcoin", "wallet", etc. but couldn't even locate an empty folder or traces of the program. I mainly focused on bitcoin-QT and multibit recovery.
I ran pywallet too with no success.

The wallet MAY be encrypted, but probably isn't. How would this affect recovery?

And mainly, what are my options if physical recovery fails?
anonymous
CC BY-SA 3.0
2013-12-03T20:06:49.500Z
The OS was on an encrypted container? That could complicate things. How is it encrypted? Here's a utility that scans a storage device for deleted wallet data. I'm not sure, but it might be possible to pipe in a decoded image of your drive:
https://bitcointalk.org/index.php?topic=25091.0 At any rate, the first step is to recover the wallet.dat file (or whatever portion you can). If the file was itself specifically encrypted (via the basic client), then some bruteforcing can be done if you used a simple password.
Mike Asdf
CC BY-SA 3.0
2013-12-03T20:23:14.010Z
Does that container still exist and can you open it? If so, you should make an image of that contents (non-encrypted). If not, I guess you're out of luck.
Jannes
CC BY-SA 3.0
2013-12-03T20:34:58.000Z
It sounds like you've been using filesystem-level recovery tools. Those need the basic structure of a filesystem intact (directory and filesnames) and the basic structure of the database (wallet) file (Berkeley DB) intact. A last resort would be getting the first x bytes the partition and then trying to see if it's a valid key. If not, move to the next byte and try that. Until the end. (Maybe the tool @MikeF pointed to does that, not sure) This is why I asked whether the wallet is encrypted, because then even that wouldn't work anymore.
Jannes
CC BY-SA 3.0
2013-12-03T23:37:42.377Z
Thank you Mike F, I'll give physical recovery another shot using that tool. However as I said I've done a lot of searching already and it's not looking good. Jannes, I can easily decrypt the container. I shouldn't need to bruteforce the password to my wallet either.
Could any of you tell me how to recover my private key if I used a program other than bitcoin-QT? Considering it was a wallet program dated 2011 there can't be that many options. What else is there? What if I'm not looking for wallet.dat? And what if I really can't recover my private key, are there ANY other options?
anonymous
CC BY-SA 3.0
2013-12-04T07:47:41.440Z
If it was that far back, I can hardly imagine someone using any other wallet program. The private key is mandatory; all bitcoin transactions require the private key(s) of the source funds in order to sign the transaction and make it valid.
Mike Asdf
CC BY-SA 3.0
2013-12-04T10:20:51.130Z
The tool that Mike F pointed to will do the low-level scan for specific bytes that I mentioned. I looked in the source code a bit and it scans for certain byte patterns that are expected to surround the private keys. It does not really look for a wallet.dat file, it just looks for the bytes it needs. So just make sure that you point that tool to the UNencrypted (copy of the) container. That really is your last hope as far as I can think of.
Jannes
CC BY-SA 3.0
2013-12-07T18:50:08.523Z
I seem to be having a problem while using the tool Mike F talked about: https://bitcointalk.org/index.php?topic=25091.0
I downloaded and burned system rescue cd and booted my computer from it. Downloaded the tool, unpacked it and.. Well, then this happens: https://bitcointalk.org/index.php?topic=25091.msg1513140#msg1513140 nobody has answered that guy either.. What do I do?
anonymous
CC BY-SA 3.0
2013-12-09T20:15:49.407Z
I've never used System Recovery Tools before until I tested it just now, but assuming you're using its default command-line, then apparently you're already logged in as root. In which case you can omit the word "sudo" from the command.
Mike Asdf
CC BY-SA 3.0
2013-12-09T20:17:29.180Z
In case Jannes and I weren't clear enough: make sure you pass the **unencrypted, uncompressed** image to the tool, **not** the default `/dev/sda`. i.e. your command will be something like: `./wallet-recover-0.3-linux/bin/32/wallet-recover /mnt/someDriveOrNetworkPath/DecryptedDriveImage.bin recovered-wallet.dat`
Mike Asdf
CC BY-SA 3.0
2013-12-03T17:21:13.103Z
2013-12-03T17:21:13.103Z
Jannes
<p>A few years ago I purchased some bitcoins from MtGox and decided to retrieve them to the wallet on my PC.</p>

<p>Now without getting into detail I got sick of the headaches and ended up uninstalling the program before I received ANY coins. In retrospect I could not have been a bigger idiot.</p>

<p>Now these coins are worth a small fortune and I've done everything I could think of to retrieve them. I contacted MtGox and all they could say was that the network says the transaction shows as complete. I have extensively and on a byte level searched the PC in question for remnants of my private key, with no success.</p>

<p>Which brings me to the question at hand.</p>

<p>I still have my public key, the knowledge the coins were never received and access to the MtGox account they were sent from.</p>

<p>What can I do? MtGox simply left it at "the network says it was completed, therefore fuck off" </p>

CC BY-SA 3.0
2014-01-02T20:55:44.130Z
You're wrong, though; the coins _were_ received. Mt.Gox sent them to your address, and that transaction was written into the blockchain. Even if they wanted to, Mt.Gox couldn't get them back without the private key of your wallet.
NReilingh
<wallet><private-key><lost-bitcoins>
Need help recovering my bitcoins
anonymous
# Need help recovering my bitcoins

(Asked by: username_0 on 2013-12-03)

A few years ago I purchased some bitcoins from MtGox and decided to retrieve them to the wallet on my PC.

Now without getting into detail I got sick of the headaches and ended up uninstalling the program before I received ANY coins. In retrospect I could not have been a bigger idiot.

Now these coins are worth a small fortune and I've done everything I could think of to retrieve them. I contacted MtGox and all they could say was that the network says the transaction shows as complete. I have extensively and on a byte level searched the PC in question for remnants of my private key, with no success.

Which brings me to the question at hand.

I still have my public key, the knowledge the coins were never received and access to the MtGox account they were sent from.

What can I do? MtGox simply left it at "the network says it was completed, therefore fuck off"

**Tags:** wallet, private-key, lost-bitcoins

> **Comments:**
> **username_1**: You're wrong, though; the coins _were_ received. Mt.Gox sent them to your address, and that transaction was written into the blockchain. Even if they wanted to, Mt.Gox couldn't get them back without the private key of your wallet.  

---

## 1 answers

### Answer by username_2 on 2013-12-03. Score: 2

First step: stop using that harddisk absolutely immediately. Either get a new one and start using that or make a complete image on the byte level (for example with dd in linux). Any write action you do on your current disk may overwrite your private key (assuming it hasn't already).

For further steps you need to provide more info.

Which bitcoin wallet were you using?

Was your wallet encrypted with a password, do you remember?

> **Comments:**
> **username_0**: I'm not sure, I think bitcoin QT. Whatever was the most common bitcoin wallet in 2011.  
> **username_0**: Sorry, took too long to edit. As I said I just picked the most basic one of the bunch for the time. The whole OS was stored in an encrypted container stored on a regular HDD that I continued using for a while.  I searched the whole disk for terms like "bitcoin", "wallet", etc. but couldn't even locate an empty folder or traces of the program. I mainly focused on bitcoin-QT and multibit recovery. I ran pywallet too with no success.  The wallet MAY be encrypted, but probably isn't. How would this affect recovery?  And mainly, what are my options if physical recovery fails?  
> **username_3**: The OS was on an encrypted container? That could complicate things. How is it encrypted? Here's a utility that scans a storage device for deleted wallet data. I'm not sure, but it might be possible to pipe in a decoded image of your drive: https://bitcointalk.org/index.php?topic=25091.0 At any rate, the first step is to recover the wallet.dat file (or whatever portion you can). If the file was itself specifically encrypted (via the basic client), then some bruteforcing can be done if you used a simple password.  
> **username_2**: Does that container still exist and can you open it? If so, you should make an image of that contents (non-encrypted). If not, I guess you're out of luck.  
> **username_2**: It sounds like you've been using filesystem-level recovery tools. Those need the basic structure of a filesystem intact (directory and filesnames) and the basic structure of the database (wallet) file (Berkeley DB) intact. A last resort would be getting the first x bytes the partition and then trying to see if it's a valid key. If not, move to the next byte and try that. Until the end. (Maybe the tool @MikeF pointed to does that, not sure) This is why I asked whether the wallet is encrypted, because then even that wouldn't work anymore.  
> **username_0**: Thank you username_3 F, I'll give physical recovery another shot using that tool. However as I said I've done a lot of searching already and it's not looking good. username_2, I can easily decrypt the container. I shouldn't need to bruteforce the password to my wallet either. Could any of you tell me how to recover my private key if I used a program other than bitcoin-QT? Considering it was a wallet program dated 2011 there can't be that many options. What else is there? What if I'm not looking for wallet.dat? And what if I really can't recover my private key, are there ANY other options?  
> **username_3**: If it was that far back, I can hardly imagine someone using any other wallet program. The private key is mandatory; all bitcoin transactions require the private key(s) of the source funds in order to sign the transaction and make it valid.  
> **username_2**: The tool that username_3 F pointed to will do the low-level scan for specific bytes that I mentioned. I looked in the source code a bit and it scans for certain byte patterns that are expected to surround the private keys. It does not really look for a wallet.dat file, it just looks for the bytes it needs. So just make sure that you point that tool to the UNencrypted (copy of the) container. That really is your last hope as far as I can think of.  
> **username_0**: I seem to be having a problem while using the tool username_3 F talked about: https://bitcointalk.org/index.php?topic=25091.0 I downloaded and burned system rescue cd and booted my computer from it. Downloaded the tool, unpacked it and.. Well, then this happens: https://bitcointalk.org/index.php?topic=25091.msg1513140#msg1513140 nobody has answered that guy either.. What do I do?  
> **username_3**: I've never used System Recovery Tools before until I tested it just now, but assuming you're using its default command-line, then apparently you're already logged in as root. In which case you can omit the word "sudo" from the command.  
> **username_3**: In case username_2 and I weren't clear enough: make sure you pass the **unencrypted, uncompressed** image to the tool, **not** the default `/dev/sda`. i.e. your command will be something like: `./wallet-recover-0.3-linux/bin/32/wallet-recover /mnt/someDriveOrNetworkPath/DecryptedDriveImage.bin recovered-wallet.dat`  

---

