<p>Back in 2013 my grandfather bought BTC. Wallet.dat file was lost most likely due to pc formatting. He would like to recover his wallet or bitcoins or whatever is possible I don't understand much about this topic.</p>
<p>I don't know the details, but here is all I know:</p>
<ul>
<li>The supposed date of transaction</li>
<li>Wallet was most likely created using Bitcoin-qt</li>
<li>I have a snapshot of the transaction made back in 2013 where his
public address appears</li>
<li>I have access to the same laptop supposedly used to create the wallet</li>
<li>Laptop was probably formatted at some point</li>
<li>I found a file I don't know what it is that weighs around 6mb, and
consists of only Alphanumeric strings and a headers for Msftedit
5.41.21.2510 (copy paste?)</li>
<li>Searching laptop does not yield any wallet.dat file but lots of
bitcoin related files</li>
</ul>
<p>Using a file recovery tool is a last resort due to the laptop being formatted (is that word correct?) part and I just don't want to go there yet.</p>
<p>He is very cautious (except for not backing up wallet.dat lol) and that weird file is stored in a folder named BITCOIN along with a file holding the voucher of his transaction so even if it is not the wallet it should be related to bitcoin.</p>
<p>1 Does anybody know what could be done?
2 Does any body know what that weird file is?</p>
<p>I created a wallet with Bitcoin Core to see what the creation process is and there was a message stating that if the wallet was being created from a backup file then the security phrase would be the same for that backedup wallet. This hints that there is a way of restoring backup files but I didn't come across it.</p>
<p>3 Would that recovery process help? What file do I need?</p>
<p>EDIT</p>
<p>In answer to David Schwartz:</p>
<p>Yes the string appears in the file. These are the firs lines of the file, for easy ilustration:</p>
<blockquote>
<p>{\rtf1\ansi\ansicpg1252\deff0\deflang13322{\fonttbl{\f0\fnil\fcharset0
Calibri;}} {*\generator Msftedit
5.41.21.2510;}\viewkind4\uc1\pard\sa200\sl240\slmult1\lang10\f0\fs22{\pict\wmetafile8\picw28152\pich16404\picwgoal15960\pichgoal9300
010009000003380618000000220618000000050000000b0200000000050000000c021440f86d22
061800430f2000cc00000000035605000000001440f86d00000000280000005605000000030000</p>
</blockquote>
<p>The file goes on and is around 80k lines long. My grandfather is not very tech savvy so this could be anything, perhaps taken from the website.</p>
<p>Last lines from file are these:</p>
<blockquote>
<p>dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9
dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6eee6df9a948ef1ebe5e9
dfd6e9dfd60000030000000000 }\par \pard\sa200\sl276\slmult1\par }</p>
</blockquote>
<p>UPDATE 2:</p>
<p>As RedGrittyBrick said, the file was opened correctly using MS wordpad and, as I imagined, it is a capture of the bitcoin core program with the transaction.</p>
<p>So it is no use. Last thing I was thinking, <strong>is there any header to bitcoin wallets?</strong> The laptop is full of files scattered all over, so if I can run a search for that header on all the file system it might bring something up.</p>
<p>I would very much appreciate your help guys, thanks in advance
Alvaro</p>

CC BY-SA 4.0
2021-07-12T00:40:04.470Z
Can you tell us more about that file? What do you mean by "a headers for Msftedit 5.41.21.2510" exactly? Does the string "5.41.21.2510" appear in the file?
David Schwartz
CC BY-SA 4.0
2021-07-12T13:13:18.070Z
I was searching around about msft edit and it seems this might be an image my grandfather tried to save using notepad, so no use apparently
Alvaro
CC BY-SA 4.0
2021-07-12T13:23:03.023Z
The string `{\rtf1` suggests this file is in Rich Text Format (RTF) which can be opened using Microsoft wordpad (press `Win`+`R` keys together then enter `wordpad`)
RedGrittyBrick
<client><wallet-recovery><wallet.dat>
Triying to help grandpa recover his bitcoins
Alvaro
# Triying to help grandpa recover his bitcoins

(Asked by: username_0 on 2021-07-11)

Back in 2013 my grandfather bought BTC. Wallet.dat file was lost most likely due to pc formatting. He would like to recover his wallet or bitcoins or whatever is possible I don't understand much about this topic.

I don't know the details, but here is all I know:

* The supposed date of transaction
* Wallet was most likely created using Bitcoin-qt
* I have a snapshot of the transaction made back in 2013 where his
  public address appears
* I have access to the same laptop supposedly used to create the wallet
* Laptop was probably formatted at some point
* I found a file I don't know what it is that weighs around 6mb, and
  consists of only Alphanumeric strings and a headers for Msftedit
  5.41.21.2510 (copy paste?)
* Searching laptop does not yield any wallet.dat file but lots of
  bitcoin related files

Using a file recovery tool is a last resort due to the laptop being formatted (is that word correct?) part and I just don't want to go there yet.

He is very cautious (except for not backing up wallet.dat lol) and that weird file is stored in a folder named BITCOIN along with a file holding the voucher of his transaction so even if it is not the wallet it should be related to bitcoin.

1 Does anybody know what could be done?
2 Does any body know what that weird file is?

I created a wallet with Bitcoin Core to see what the creation process is and there was a message stating that if the wallet was being created from a backup file then the security phrase would be the same for that backedup wallet. This hints that there is a way of restoring backup files but I didn't come across it.

3 Would that recovery process help? What file do I need?

EDIT

In answer to username_1 username_1:

Yes the string appears in the file. These are the firs lines of the file, for easy ilustration:

> {\rtf1\ansi\ansicpg1252\deff0\deflang13322{\fonttbl{\f0\fnil\fcharset0
> Calibri;}} {\*\generator Msftedit
> 5.41.21.2510;}\viewkind4\uc1\pard\sa200\sl240\slmult1\lang10\f0\fs22{\pict\wmetafile8\picw28152\pich16404\picwgoal15960\pichgoal9300
> 010009000003380618000000220618000000050000000b0200000000050000000c021440f86d22
> 061800430f2000cc00000000035605000000001440f86d00000000280000005605000000030000

The file goes on and is around 80k lines long. My grandfather is not very tech savvy so this could be anything, perhaps taken from the website.

Last lines from file are these:

> dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9
> dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6eee6df9a948ef1ebe5e9
> dfd6e9dfd60000030000000000 }\par \pard\sa200\sl276\slmult1\par }

UPDATE 2:

As username_2 said, the file was opened correctly using MS wordpad and, as I imagined, it is a capture of the bitcoin core program with the transaction.

So it is no use. Last thing I was thinking, **is there any header to bitcoin wallets?** The laptop is full of files scattered all over, so if I can run a search for that header on all the file system it might bring something up.

I would very much appreciate your help guys, thanks in advance
username_0

**Tags:** client, wallet-recovery, wallet.dat

> **Comments:**
> **username_1**: Can you tell us more about that file? What do you mean by "a headers for Msftedit 5.41.21.2510" exactly? Does the string "5.41.21.2510" appear in the file?  
> **username_0**: I was searching around about msft edit and it seems this might be an image my grandfather tried to save using notepad, so no use apparently  
> **username_2**: The string `{\rtf1` suggests this file is in Rich Text Format (RTF) which can be opened using Microsoft wordpad (press `Win`+`R` keys together then enter `wordpad`)  

---

## 0 answers

