I am writing a C++ application to scour large files (typically disk images) for wallet.dat files, with the intention of recovering the private keys.

At the moment I am struggling the data contained in the ‘mkey’ (Master Key) section of an encrypted wallet.dat file.

From Googling and pouring over the source code for Bitcoin and various other utilities that do what I want to do (such as pywallet) I have deduced the that data layout of mkey data is:

  • mkey - a size prefixed string denoting the start of the master key data.
  • nID - an integer whose purpose I have been unable to determine.
  • encrypted_key - a size prefixed buffer containing the encrypted master key.
  • salt - a size prefixed buffer containing the salt data used when encrypting the key.
  • derivation_method - an integer containing either 0 or 1 for the method used to encrypt the master key using the wallet password.
  • derivation_rounds – an integer containing the number of rounds used to encrypt the master key.
  • other_derivation_parameters

However, having examined my wallet.dat file with a hex editor (screenshot attached) I cannot seem to get the data it contains to correlate with the above.

enter image description here

Can someone point me in the right direction or tell me what I have missed.

  • With which version Bitcoin Core and bdb was this file created? Commented Aug 18, 2016 at 13:44
  • 0.12.1 The latest version Commented Aug 19, 2016 at 7:50
  • Berkeley DB was 4.8 the standard one used with Bitcoin. I am running a Windows binary that I downloaded from the Website. Commented Aug 19, 2016 at 8:45

1 Answer 1


Hard to understand what the backstory is on this without more info. It may be helpful to double-check your understanding of the mkey data structure and compare it to other sources to make sure that you have the correct information. Additionally, it may be helpful to reach out to experts in the field or BTC forums dedicated to cryptocurrency and wallet recovery, or in Bitcoin laundry and mixer chats, where this sort of thing is more common, to see if they can provide further guidance.

Attempting to recover private keys from someone else's wallet.dat file without their permission is likely illegal and unethical. It's important to ensure that you have proper authorization and consent before attempting any wallet recovery efforts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.