View backed up wallet.dat using sqlite browser

Question

I backed up my wallet.dat using the command as mentioned in the api ref:

bitcoin-cli -rpcport=18332 -rpcuser=user -rpcpassword=password backupwallet "/bitcoin/backup.dat"

I would like to view the backed-up db file using 'DB browser for sqlite' (or any other sqlite browser). However when opening the db file it prompts for the password / key to decrypt the wallet file.

Which password / key is it referring to? When creating the backup I didnt specify any password or key..

Answer 1

db_dump

You can use db_dump from the Berkeley db-utils package.

I've used that under Windows-10 by using WSL (Ubuntu) - It can definitely dump an unencrypted Bitcoin wallet.dat file.

The Berkeley DB libraries used by Bitcoin core for the wallet.dat are a key-value store - and the keys used appear to be words like "key" and "keymeta".

As far as I know, the structure (if not simple data types) of the key and value are not known to the DB libraries. I believe applications such as Bitcoin core will often be storing blobs whose contents cannot be dissected by general tools which lack knowledge of the applications' schema. The same observations are likely to apply to sqlite browser

However db_dump output is a worthwhile step up from a hex dump! The -p or -da options may be useful.

---

SQLite

https://github.com/bitcoin/bitcoin/pull/19077 says

This PR adds a new class SQLiteDatabase which is a subclass of WalletDatabase. This provides access to a SQLite database that is used to store the wallet records. To keep compatibility with BDB and to complexity of the change down, we don't make use of many SQLite's features. We use it strictly as a key-value store. We create a table main which has two columns, key and value both with the type blob.

...

We keep the name wallet.dat for SQLite wallets. We are able to determine which database type to use by searching for specific magic bytes in the wallet.dat file. SQLite begins it's files with a null terminated string SQLite format 3. BDB has 0x00053162 at byte 12 (note that the byte order of this integer depends on the system endianness). So when we see that there is a wallet.dat file that we want to open, we check for the magic bytes to determine which database system to use.

I'm using current Bitcoin core 0.21.0, but the wallet I examined was first generated in 2018 and has the Berkeley DB (BDB) signature. Bitcoin core has not rewritten the file in a newer/different format.

https://github.com/bitcoin/bitcoin/issues/20160 provides a timeline for the phasing out of Berkely DB (which obviously affects the contents of this answer)

---

Wallet.dat

My brief examination of a wallet.dat backup using a hex-dump suggested that the wallet mostly contains private keys, addresses generated and some sparse metadata about each.

See also

• dumpwallet output documentation & explanation? (2021 and relevant)
• What do the different .dat files contain? (2011, ∴ limited usefulness)
• File format -- rev*.dat (2017, interesting but different file)
• What is the database for? (2013, ∴ limited usefulness)
• UXTO DB structure (2017, not relevant but interesting documentation)

wallet.dat contains your private keys, your address book, a copy of the transactions that send coins from or to one of your addresses, accounts, reserve keys, personal settings, and a pointer to the current best block.

(Note: Bitcoin core's "accounts" feature was deprecated some years ago)