Bitcoin HELP

[JohnQPublic]

I lost my bitcoin wallet. I do have the hard drive on a functioning machine, but it has been written over by a newer version of Linux.

I do have my bitcoin qt passphrase. I have the public key to any transactions I do have. I used the passphrase to create what I understand to be usable private keys (I ran this on Linux: echo -n|'passphrase'|sha256sum|grep -o '[0-9a-f]*' ).

Short of trying to scan my hard drive to recover wallet.dat, is there a reasonable way to recover my bitcoins with the information I have? I created a new bitcoin wallet and updated it.

I never had any bitcoins, then in 2014 after I lost the wallet I was sent some coin during the donation period. I have all my other coin types, but since I did not have bitcoin, I neglected to back-up the wallet (at least I have not found a back-up yet).

Any help would be appreciated.

[monty]

I think without wallet.dat there is no chance. Is it possible to locate the missing file with the dd command?

[monty]

For text strings, can it be used for file name?

Ok, say you want to find out if your girlfriend or wife is cheating on you, having cyber sex, or just basically misbehaving with her computer. Even if the computer is secured with a password, you can boot with the:

http://www.efense.com/helix

CD and search the entire drive partition for text strings:

dd if=/dev/sda2 bs=16065 | hexdump -C | grep 'I really don't love him anymore.'

Will search the whole drive partition for the text string specified between the single quotes. Searching an entire disk partition several times can be quite tedious. This particular command string prints the search results to the screen, with the offset where it is located in the partition. dd works in the decimal system. Disk offsets work in hexidecimal.
Say you found that text string in your partition at offset 020d0d90. You convert that to decimal with one of the many calculators found in linux. This is decimal offset 34409872. Dividing by 512b per sector we get 67206.78125. now we know, to read the rest of what ever it is, and these numbers are just guestimates:

dd if=/dev/sda2 bs=16065 skip=2140 count=3 | less

This will put the output to the screen so you don't accidentally write a file over what you want to read. Piping dd to less will give you one screen at a time of output. With this method you search all the deleted files, any chat activity, and emails. It works no matter what security is being employed on the machine. It works with NTFS, ext2, ext3, reiserfs, swap, and FAT partitions. The helix CD is not fussy, and neither is the dd command.

On a related note, you can write the system memory to a CD. This is useful for documenting memory contents without contaminating the HDD. I recommend using a CD-RW so you can practice a little. This doesn't involve dd, but it's cool.

http://www.linuxquestions.org/linux/answers/Applications_GUI_Multimedia/How_To_Do_Eveything_With_DD

[Jewboo]

I lost my bitcoin wallet. I do have the hard drive on a functioning machine, but it has been written over by a newer version of Linux.

I do have my bitcoin qt passphrase. I have the public key to any transactions I do have. I used the passphrase to create what I understand to be usable private keys (I ran this on Linux: echo -n|'passphrase'|sha256sum|grep -o '[0-9a-f]*' ).

Short of trying to scan my hard drive to recover wallet.dat, is there a reasonable way to recover my bitcoins with the information I have? I created a new bitcoin wallet and updated it.

I never had any bitcoins, then in 2014 after I lost the wallet I was sent some coin during the donation period. I have all my other coin types, but since I did not have bitcoin, I neglected to back-up the wallet (at least I have not found a back-up yet).

Any help would be appreciated.

https://www.piriform.com/recuva

free version works fine

[JohnQPublic]

https://www.piriform.com/recuva

free version works fine

Thanks, but isn't this for Windows?

[Jewboo]

Thanks, but isn't this for Windows?

Put your overwritten hard drive in a Windows system as the D: drive then run the free Recuva on that Windows system.

[Glass]

There are a few tools out there for recovery. It gets hard when things are written to the drive either by format, new install or booting. Usually a format or file delete only deletes the pointer to the file location. If the file is still there and nothing has been over written to the files locations. you can grind through the sectors piecing the file pointers back together. If even one of the sectors where the files was stored has been over written the file it toast.

Step 1 - Mirror or image the hard drive. Make a copy of it before doing anything.

http://www.makeuseof.com/tag/how-to-...recover-files/
Have a look at Parted Magic on this page. The page is a few years old, but the file types Linux uses are still the same.

It should be able to tell you what files have been "deleted" and maybe it can tell you the chance of recovery.

http://www.linuxandubuntu.com/home/5...ted-partitions
I've used a few tools on this page, but these tend to be for drives that have not been written to after the files or partitions have been deleted.

Just to be clear, you want to take that drive out of the PC it is running and attach it to another PC when running these tools. You don't want these tools to be tempted to write to it while they are working.

[madfranks]

I hope you can recover your lost wallet. If you do, first thing you should do is make a backup of your encrypted wallet file and email it to yourself so it's in the cloud. Then every time you make a deposit, make a new backup and email it again.

[Glass]

sorry parted magic is probably only going to do whole partitions. Not really clear but there are a couple other tools on there worth throwing at it.

I've used disk internals. The free version can probably tell you how much success you will have. Then you can decide about forking out $$.

anyway duplicate the drive and throw everything you can find at that duplicate.

[JohnQPublic]

Thanks everyone. I tried this: https://github.com/pierce403/keyhunter (http://www.pxdojo.net/2013/12/bitcoi...ecromancy.html explanation).

It did not find anything.