Unrecoverable file - REWARD 25.000 USD!!!

[Klerni]

I'm struggling by lost of very important file. To be honest I don't need even all of it, just small parts of file. The problem is that it's deleted and let's assume that it's overwritten.
I hope that not but let's think about worse scenario.

I will pay 25.000USD to magician who know how to recover file - or right part of it, which is deleted and overwritten, no matter what way, magnetic or whatever.

Is here anybody or do you know somebody who is able to do some magics like that?

[lcoughey]

To be clear, $25,000USD (twenty-five thousand US Dollars)?

[Klerni]

Yes exactly

[jermy]

Deleted and overwrriten ?

[Klerni]

Deleted 100% , overwritten, not sure but it is very possible and I would like to have person who know all of those tricks used in special agencies

Last edited by Klerni on March 22nd, 2016, 16:50, edited 2 times in total.

[jermy]

willing to offer 25K $, I will have to assume that it has been by at least one DR firm, and declared a lost cause ?!

[Klerni]

Wallet.dat - bitcoin wallet

This what you can already imagine I need one correct private key. Already looked for them through hex edit on entire disk with root user. Found around 1100 of them but none of them was my treasure. That's why I'm considering it may be overwritten.
BTW It's SSD

I'm willing to pay for plane tickets to my house but before I need to be sure that this person will be really able to fix my issue.

Last edited by Klerni on March 22nd, 2016, 16:55, edited 1 time in total.

[lcoughey]

If it's overwritten then there is no way to recover.

Unless you are using a magical app like SpinRite or HDDRegenerator...when combined with a freezer, they go back in time and get files before they are lost.

[jermy]

overwritten, not sure

what does it mean "not sure" ?

[jermy]

Unless you are using a magical app like SpinRite or HDDRegenerator...when combined with a freezer, they go back in time and get files before they are lost.

Last edited by jermy on March 22nd, 2016, 16:58, edited 1 time in total.

[Klerni]

overwritten, not sure

what does it mean "not sure" ?

Found around 1100 of them but none of them was my treasure. That's why I'm considering it may be overwritten.

[data-medics]

If it's an SSD and TRIM is enabled the data's already gone forever. TRIM will zero out blocks of data after a file is erased, so recovery is almost certainly impossible.

[Klerni]

How can I check is TRIM enabled or not?

[fzabkar]

If it's an SSD, then the file's remnants may still be in the overprovisioned space. Provided that the entire drive has not been wear levelled, then there is a chance your data may still be there. AISI, you don't need to pay $25K. Just ask someone to do a normal chip-off recovery. In fact they shouldn't need to do any recovery at all. Just ask them to read each block, apply ECC, and supply you with the complete, raw, error corrected dumps. Then you only need to scan each block for your key(s). That's assuming that there is no hardware encryption.

[jermy]

Not that simple.

+1, not to mention if there is additional encryption made by the user

[Klerni]

there is no additional encryption

Wallet.dat - bitcoin wallet is a file that have a crypto key. It will look like random "garbage". The file have a header that can be scanned for but if the file is "fragmented" it will be very hard to find the pieces of the file all across the drive as the content will look like gibberish apart from the start of the file ...

So won't just work scan of all storage by root for pattern which recognize private keys?
It's only about couple of bits..

// structure of compressed private key
// "3081D30201010420" + private key (32 bytes) +
// structure of a private key: 
// "308201130201010420" + private key (32

[Klerni]

Assuming OP is using original BitCoin software

Yes it is : )

[Klerni]

I have also receive address.. where coins are.

If I looked for it in hex edit found results but only from (of course non existing - so not everything is overwritten) file from sender address. The problem is, it's connected only to sender transaction..

Yes I sent it between my two wallet.dat's

Maybe for receiving address is uncompressed? - if yes, is there any way to uncompress my compressed receive address?

@

Do a IMAGE of the drive first. You don't want to write anything more to the drive.

Already did

The problem is that already know it. Even further.. I know that it's not only about "keyA or pool".. If you will look foward we are looking for scheme below

// structure of compressed private key
// "3081D30201010420" + private key (32 bytes) +
// structure of a private key:
// "308201130201010420" + private key (32

If you search for those bytes in hex edit, then you will have exactly private keys
Already have software which is extracting it from all my storage and it found more than 1k keys.
None of them match to my receive address..

Last edited by Klerni on March 22nd, 2016, 17:36, edited 1 time in total.

[Klerni]

Scan the image for that address

Do you mean my receive address?

But as I wrote, can't find it as receiver of transaction.. Only as sender. Private key of sender of course is useless because.. there are no money

You will have to send me the image file of your SSD or a clone of it, even if it's on a normal hdd.

As you can imagine I won't send image file of my ssd to anybody The only way is to fly to my house but for now the problem is that there is no address found... This transaction is missing, so you can't rebuild file without it.. Or am I wrong?

Last edited by Klerni on March 22nd, 2016, 17:41, edited 1 time in total.

[Klerni]

The problem is that I created wallet.dat from those private keys.. There were 40 transactions, which is funny because 200 are on existing files..