0

Back in 2013 my grandfather bought BTC. Wallet.dat file was lost most likely due to pc formatting. He would like to recover his wallet or bitcoins or whatever is possible I don't understand much about this topic.

I don't know the details, but here is all I know:

  • The supposed date of transaction
  • Wallet was most likely created using Bitcoin-qt
  • I have a snapshot of the transaction made back in 2013 where his public address appears
  • I have access to the same laptop supposedly used to create the wallet
  • Laptop was probably formatted at some point
  • I found a file I don't know what it is that weighs around 6mb, and consists of only Alphanumeric strings and a headers for Msftedit 5.41.21.2510 (copy paste?)
  • Searching laptop does not yield any wallet.dat file but lots of bitcoin related files

Using a file recovery tool is a last resort due to the laptop being formatted (is that word correct?) part and I just don't want to go there yet.

He is very cautious (except for not backing up wallet.dat lol) and that weird file is stored in a folder named BITCOIN along with a file holding the voucher of his transaction so even if it is not the wallet it should be related to bitcoin.

1 Does anybody know what could be done? 2 Does any body know what that weird file is?

I created a wallet with Bitcoin Core to see what the creation process is and there was a message stating that if the wallet was being created from a backup file then the security phrase would be the same for that backedup wallet. This hints that there is a way of restoring backup files but I didn't come across it.

3 Would that recovery process help? What file do I need?

EDIT

In answer to David Schwartz:

Yes the string appears in the file. These are the firs lines of the file, for easy ilustration:

{\rtf1\ansi\ansicpg1252\deff0\deflang13322{\fonttbl{\f0\fnil\fcharset0 Calibri;}} {*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\sa200\sl240\slmult1\lang10\f0\fs22{\pict\wmetafile8\picw28152\pich16404\picwgoal15960\pichgoal9300 010009000003380618000000220618000000050000000b0200000000050000000c021440f86d22 061800430f2000cc00000000035605000000001440f86d00000000280000005605000000030000

The file goes on and is around 80k lines long. My grandfather is not very tech savvy so this could be anything, perhaps taken from the website.

Last lines from file are these:

dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9 dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6e9dfd6eee6df9a948ef1ebe5e9 dfd6e9dfd60000030000000000 }\par \pard\sa200\sl276\slmult1\par }

UPDATE 2:

As RedGrittyBrick said, the file was opened correctly using MS wordpad and, as I imagined, it is a capture of the bitcoin core program with the transaction.

So it is no use. Last thing I was thinking, is there any header to bitcoin wallets? The laptop is full of files scattered all over, so if I can run a search for that header on all the file system it might bring something up.

I would very much appreciate your help guys, thanks in advance Alvaro

Alvaro
  • 1
  • 1
  • Can you tell us more about that file? What do you mean by "a headers for Msftedit 5.41.21.2510" exactly? Does the string "5.41.21.2510" appear in the file? – David Schwartz Jul 12 '21 at 00:40
  • I was searching around about msft edit and it seems this might be an image my grandfather tried to save using notepad, so no use apparently – Alvaro Jul 12 '21 at 13:13
  • The string {\rtf1 suggests this file is in Rich Text Format (RTF) which can be opened using Microsoft wordpad (press Win+R keys together then enter wordpad) – RedGrittyBrick Jul 12 '21 at 13:23

0 Answers0