How to tell if a file is a Bitcoin wallet?

Question

This question is very similar to this one ("Identifying wallet file among soup of recovered .dat files"), but slightly different.

I ran photorec and ended up with a bunch of files. Per this answer, I ran file and found one that had the exact description mentioned: Berkeley DB (Btree, version 9, native byte-order)

Can I easily tell if this is a bitcoin wallet file or just some DB file used by another application? It sounds like photorec can't find the EOF for these files, so mine is probably larger than the original file was. Are there any tools that might help me here?

Answer 1

the wallet.dat file is a database to store the keys. It has a length of several Megabytes, and tends to grow with the number of tx/keys. Make a copy of it onto a USB drive, and put it aside! If you are on a unixoide system, have a look at the tool "hexdump". You could copy the first 5 kilobytes (dd if=xxx.dat of=/tmp/mytest bs=1024 count=5), and then use "hexdump -C /tmp/mytest". If it looks like this:

00000000  00 00 00 00 01 00 00 00  00 00 00 00 62 31 05 00  |............b1..|
00000010  09 00 00 00 00 10 00 00  00 09 00 00 00 00 00 00  |................|
00000020  3f 2b 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |?+..............|
00000030  20 00 00 00 36 2a 93 00  02 00 00 01 1d f3 cd 88  | ...6*..........|
00000040  18 03 00 00 00 00 00 00  00 00 00 00 02 00 00 00  |................|
00000050  00 00 00 00 20 00 00 00  01 00 00 00 00 00 00 00  |.... ...........|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000  00 00 00 00 01 00 00 00  01 00 00 00 00 00 00 00  |................|
00001010  00 00 00 00 02 00 f0 0f  01 05 f8 0f f0 0f 00 00  |................|
00001020  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00001030  20 00 00 00 36 2a 93 00  02 00 00 01 1d f3 cd 88  | ...6*..........|
00001040  18 03 00 00 00 00 00 00  00 00 00 00 02 00 00 00  |................|
00001050  00 00 00 00 20 00 00 00  01 00 00 00 00 00 00 00  |.... ...........|
00001060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001ff0  04 00 01 00 00 00 02 00  04 00 01 6d 61 69 6e 00  |...........main.|
00002000  00 00 00 00 01 00 00 00  02 00 00 00 62 31 05 00  |............b1..|
00002010  09 00 00 00 00 10 00 00  00 09 00 00 00 00 00 00  |................|
00002020  02 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00002030  20 00 00 00 36 2a 93 00  02 00 00 01 1d f3 cd 88  | ...6*..........|
00002040  18 03 00 00 00 00 00 00  00 00 00 00 02 00 00 00  |................|
00002050  00 00 00 00 20 00 00 00  03 00 00 00 00 00 00 00  |.... ...........|
00002060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002200  c7 76 7b 67 ff 4d fe 20  f0 4f ef 1f 98 be f0 7c  |.v{g.M. .O.....||

then indeed there is a high possibility for your wallet file. If you are on windows, there are freeware tools to hexdump or hexedit files, you may not even need the command line.