A Fortune Locked on Your HDD: How to Rescue Lost Bitcoins

Illustration for article titled A Fortune Locked on Your HDD: How to Rescue Lost Bitcoinsem/em

Once a dubious term familiar only the most avid tech nerds, bitcoin has taken the world by storm, having become one of the most lucrative forms of investment around the globe. While the majority still remains skeptical about the future of this digital currency, more and more people rush to join in, predicting its roaring success for many years to come. Anyhow, being free from any government or bank control and protected by unbreakable cryptography, the “cryptocurrency” is considered to be a convenient and safe way to keep wealth, but the illusion of its total security crashes into reality when things go wrong and your digital riches end up out of your reach by accident or even because of your own mistake.


The cryptocash is stored in the so-called wallet on a hard disk drive or any other digital medium, and just like a real one, a digital wallet can be lost, for example due to unintentional deletion, mistaken formatting or damage of a disk it was kept on, leaving the owner in front of a broken-down trough. But in contrast to a real purse left behind in transport, fortunately, your bitcoin wallet has much higher chances for getting back, still, you have no time to lose.

Depending on the circumstances, there are several possible modi operandi, but in any case, you’ll have fish for a wallet file which contains the most crucial information, such as secret keys, transactions, metadata, etc. If you use the original Bitcoin Core client, it should be called wallet.dat, though other less popular clients may utilize their own custom formats whose properties you have to find out.


Uninstalled bitcoin software

If you removed or re-installed your Bitcoin Core client, nothing happened to its data files since all of them are stored in a separate directory which is hidden by default. Depending on the operating system you use, you can find wallet.dat by going to:


Start -> Run -> %APPDATA%\Bitcoin


find / -name wallet.dat -print 2>/dev/null


~/Library/Application Support/Bitcoin/

Having found the file, you can easily import it to your Bitcoin Core.

Accidentally deleted wallet file

If you unwittingly deleted your wallet.dat, first of all, check the Recycle Bin and all the backups you may have. If it is not there, you still can retrieve it using data recovery software tools downloaded from the Internet. Just let the program scan the drive and then enter wallet.dat into the search line to quickly find the needed file among the search results and save it to a safe location. However, you should remember that further use of the storage after wallet deletion minimizes the chances of its successful retrieval and can even make the file absolutely unrecoverable due to its overwriting by some other content. That is why you should by all means prevent any writing operations to the affected disk. If wallet.dat was stored in a system partition, even running the OS may lead to writing some information to the storage, thus, to be on the safe side, unplug the drive and connect it to another computer using a spare bay or IDE/SATA cable, having installed data recovery software on that PC.


Formatted drive

The possibility to restore the lost wallet in this case depends solely on the type of formatting and file system applied. If you chose the full format option, unfortunately, all the data has been wiped and in no way can be recovered. In contrast, if you ran a quick format, all of your files are likely to still be left on the disk, so you can retrieve them by reconstructing the deleted file system and locating the wallet file using the tools mentioned above. However, if the storage has been in use for some time after formatting, the chances for success drastically drop.


Moreover, the way some file systems perform the formatting procedure (for instance HFS+ of macOS and Ext of Linux) makes it impossible to recover files together with their original names or folders and, thus, hinder locating wallet.dat. In this case, you may need to look for it manually. As a rule, it starts with the following hex value:

00 00 00 00 01 00 00 00 00 00 00 00 62 31 05 00

Virus attacks and other types of logical damage

If the wallet file went missing as a result of a software issue, as a rule, the same techniques should be applied as in the case of a formatted file system. The likelihood of a fortunate outcome depends on the type and severity of the file system damage.


Physical failure of a storage

If the hard drive your wallet is stored on is clicking or producing unusual noises, cannot be recognized in Disk Management (Disk Utility) or fails to be mounted, became extremely slow or contains a lot of bad sectors, it has probably encountered physical failure. In such an event it is very undesirable to attempt DIY data recovery of the files it holds, as this may lead to their permanent loss. The optimum solution would be to consult a specialized data recovery center. But if you don’t have such an option and ready to take a risk, you should at least create a disk image of the failing drive using a system or third-party utility and work with this image instead of the physical storage. Fortunately, some data recovery tools, such as Recovery Explorer, enable data recovery from disk image file, a sector-by-sector copy of the original storage medium.


As soon as you’ve succeeded in salvaging your Bitcoin wallet, think about the options that may keep you from losing it again. You may create its backup copy on a removable storage, such as a USB flash drive, use a cloud or even upgrade to RAID5.

Share This Story

Get our newsletter