10

A customer of mine brought me a 2TB crashed harddrive. The drive itself is not damaged physically, but the file tables (MFT / NTFS) are corrupt so there is zero ability to recover files with their original names.

The contents of the drive is not important, except for the customer's wallet.dat file which contains "a substantial amount of bitcoins" (sic).

Finding this file among 2TB of data is pretty much a needle in a haystack.

So, question: Does wallet.dat contain anything unique, anything that can be binary searched for, anything that makes it say "hey, I'm wallet.dat!"?

  • Note that there are some open source wallet recovery told out there that might help find out salvage it. I don't have experience with them though, so you'd have to try. – Jannes Nov 21 '15 at 12:51
14

It has magic bytes plus a version number at byte 12 in the file:

00000000 [00 00 00 00 01 00 00 00] [00 00 00 00] [62 31 05 00]
                     ^ lsn               ^ page num    ^ magic
00000010 [09 00 00 00] [00 20 00 00] 00 [09] 00 00 00 00 00 00
               ^ version     ^ page size  ^ db type

Searching for 62 31 05 00 09 00 00 00 should get you what you're looking for.

Source: berkleydb source code: layout, magic number

If that doesn't work, there are a couple of patterns you might find handy:

  • 00 01 07 6b 65 79 6d 65 74 61 (keymeta)

  • 00 01 0a 64 65 66 61 75 6c 74 6b 65 79 (defaultkey)

  • 00 01 0a 6d 69 6e 76 65 72 73 69 6f 6e (minversion)

  • 00 01 09 62 65 73 74 62 6c 6f 63 6b (bestblock)

  • 00 01 03 61 63 63 (acc) Account

  • 00 01 03 6b 65 79 (key)

  • 00 01 04 63 6b 65 79 (ckey) Encrypted key

  • 00 01 04 6d 6b 65 79 (mkey) (Only in encrypted wallets)

  • 00 01 04 6e 61 6d 65 (name)

  • 00 01 07 70 75 72 70 6f 73 65 (purpose)

There's a list of the tokens it uses in this source file, and you can see an explanation of what they correspond to here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.