Filesystem is corrupt. How to find wallet.dat?

Question

A customer of mine brought me a 2TB crashed harddrive. The drive itself is not damaged physically, but the file tables (MFT / NTFS) are corrupt so there is zero ability to recover files with their original names.

The contents of the drive is not important, except for the customer's wallet.dat file which contains "a substantial amount of bitcoins" (sic).

Finding this file among 2TB of data is pretty much a needle in a haystack.

So, question: Does wallet.dat contain anything unique, anything that can be binary searched for, anything that makes it say "hey, I'm wallet.dat!"?

Answer 1

It has magic bytes plus a version number at byte 12 in the file:

00000000 [00 00 00 00 01 00 00 00] [00 00 00 00] [62 31 05 00]
                     ^ lsn               ^ page num    ^ magic
00000010 [09 00 00 00] [00 20 00 00] 00 [09] 00 00 00 00 00 00
               ^ version     ^ page size  ^ db type

Searching for 62 31 05 00 09 00 00 00 should get you what you're looking for.

Source: berkleydb source code: layout, magic number

If that doesn't work, there are a couple of patterns you might find handy:

• 00 01 07 6b 65 79 6d 65 74 61 (keymeta)

• 00 01 0a 64 65 66 61 75 6c 74 6b 65 79 (defaultkey)

• 00 01 0a 6d 69 6e 76 65 72 73 69 6f 6e (minversion)

• 00 01 09 62 65 73 74 62 6c 6f 63 6b (bestblock)

• 00 01 03 61 63 63 (acc) Account

• 00 01 03 6b 65 79 (key)

• 00 01 04 63 6b 65 79 (ckey) Encrypted key

• 00 01 04 6d 6b 65 79 (mkey) (Only in encrypted wallets)

• 00 01 04 6e 61 6d 65 (name)

• 00 01 07 70 75 72 70 6f 73 65 (purpose)

There's a list of the tokens it uses in this source file, and you can see an explanation of what they correspond to here.