Identifying wallet file among soup of recovered .dat files

Question

Hello my friends!

Here is my situation:

I accidentally deleted a partition on my HDD containing the only copy of my bitcoin wallet. Facepalm. After running data recovery tools, I've found and restored around 150 .dat files. Unfortunately, the recovery software assigns arbitrary names to these files, so I cannot identify which one is my BTC wallet.dat.

My question :

Is there a quick way or a utility that can confirm if a .dat file is a valid bitcoin wallet? I would like to run a script to iterate through each .dat and check it in order to find the bitcoin wallet among all the .dat files I recovered.

Worst comes to worst, I will just need to try to import each one, one-by-one ( (which sounds like an awful way to spend my afternoon tomorrow). I am still pretty new to BTC and unfamiliar with the set of tools it involves, so I am hoping there is a programatic way to do this :D

Answer 1

I quickly verified my system, here is what might help you to identfy:

$ file wallet.dat 
wallet.dat: Berkeley DB (Btree, version 9, native byte-order)

$ file blocks/blk00233.dat 
blocks/blk00233.dat: data

and if you have a hexdump tool (this here should work on Unixoide type systems):

$ hexdump -C wallet.dat | more
00000000  00 00 00 00 01 00 00 00  00 00 00 00 62 31 05 00  |............b1..|
... many, many zeros, and from time to time some numbers :-)
00001ff0  04 00 01 00 00 00 02 00  04 00 01 6d 61 69 6e 00  |...........main.|

whereas blooks are full of numbers...

$ hexdump -C blk00233.dat | more
00000000  f9 be b4 d9 1f ad 06 00  02 00 00 00 f2 50 36 7e  |.............P6~|
00000010  af 4f e8 37 f7 2f 0f db  8b cf a1 3e 34 73 0d eb  |.O.7./.....>4s..|
00000020  f9 ca 1d 05 00 00 00 00  00 00 00 00 76 89 01 91  |............v...|
00000030  46 d5 24 ed 48 bd ff ed  68 77 3e ca 28 0e b8 74  |F.$.H...hw>.(..t|
00000040  30 73 cb aa 0e 32 d9 91  9f a9 ed 73 b1 d2 e5 54  |0s...2.....s...T|
00000050  87 bb 18 18 90 7d 19 02  fd c6 02 01 00 00 00 01  |.....}..........|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*

as you don't want to do this for each and every file, you may want to tell your system what to do:

for i in *.dat; do file $i; done

Answer 2

Here is another, perhaps quicker version:

find /my/folder -exec file {} ";" | grep 'Berkeley'

This command will print the list of all files from /my/folder, which have the type of Berkeley DB. Above else, this is the type of the Bitcoin wallet files.