I have python script to dump wallet.dat details to json+hex file. It operates with bsddb3 library. There are keys and values. They can be divided into:
depending on the first byte.
I have: 02, 03, 05, 07, 09, 0a, 0c, 12 as the first bytes for all keys in some encrypted wallet.
What does these first bytes mean and how should I divide types of keys into groups by this first byte?
They correspond to specific record types commonly found in older legacy wallet, specificaly:
0x02: KEY - Private key entries (in very old or unencrypted wallets, these store the pubkey and corresponding private key).
0x03: WKEY - An older, now-deprecated record type related to wallet keys. It was used in very early wallet versions and isn’t typically seen in modern wallets.
0x05: NAME - Address book entries (the "label" or "name" associated with a particular Bitcoin address).
0x07: POOL - Keypool entries (pre-generated addresses/keys waiting to be used).
0x09: ACC - Account records (from older wallet versions that supported accounts, now deprecated).
0x0a: ACENTRY - Account entry records, detailing transactions or balances associated with named accounts (also deprecated).
0x0c: CSCRIPT - Storing redeem scripts (used for P2SH addresses or other special script conditions).
0x12: WTX (Transaction) - Full transaction records relevant to the wallet’s balance and history.
Grouping by Record Type:
Keys (private keys): Look for 0x02 (and sometimes 0x03 in very old wallets).
Address-related metadata: 0x05 (NAME) stores address labels.
Keypool and Account Info: 0x07 (POOL) and 0x09/0x0a (ACC/ACENTRY) for pre-HD, account-based workflows.
Scripts: 0x0c (CSCRIPT) for redeem scripts.
Transactions: 0x12 (WTX) for recorded wallet transactions.
For more information you can check this old python script that give information about wallet.dat file, you can also look into the source code
