Corrupted old bitcoin wallet. !!!file unknown has LSN!

Question

I have a corrupted UN-ENCRYPTED bitcoin wallet from 2013.

what I have tried so far with both wallet:

1, with old and new version of bitcoin client the wallet just creating a .bak file and not showing any amount/transaction.

2, i also try bitcoin-qt.exe -salvagewallet - that is creating a bak + epoch time. and the db.log saying

file unknown has LSN 91/5547280, past end of log at 1/1042 Commonly caused by moving a database from one database environment to another without clearing the database LSNs, or by removing all of the log files from a database environment wallet.dat.1608587747.bak: DB_VERIFY_BAD: Database verification failed

3, pywallet installed correctly and working fine under ubuntu for me with different wallets that not corrupted, (dumping all data just fine) but when i trying to dump the corrupted once python2 pywallet.py --dumpwallet --datadir=./ im getting the "ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again."

4, i have try the python2 dbdump.py --wallet --wallet-tx --datadir=./ (getting "ERROR:root:Couldn't open wallet.dat/main. Try quitting Bitcoin and running this again.")

Kind of run out of stuff now, how i go more deeper in this to get those private keys and addresses?

If any of you can successfully help me, reward will be issued for sure.

Answer 1

A technique with which I've had success in the past:

db5.3_dump corrupted_wallet.dat | db5.3_load fresh_wallet.dat

(obviously replacing corrupted_wallet.dat with the actual filename, and making a backup first).

and then trying to load fresh_wallet.dat into a modern Bitcoin Core

These tools are in the Ubuntu package db5.3-util.

Note: you'll need a Bitcoin Core that is compiled against libdb5.3++-dev to open this file (as it'll be using BDB 5.3, while release builds use BDB 4.8). You can do the equivalent and just use BDB 4.8 tools everywhere, but they're harder to find.

Answer 2

how i go more deeper in this to get those private keys and addresses?

Well the basic process I would start with would be

• Don't use the computer that contains the damaged file
• Use a bootable USB to make a copy of the file onto external media
• Lock the computer away until you have repaired the file or extracted keys on a new computer
• make copies of the damaged file and work only on those copies.
• keep some unaltered copies in some safe places.
• make a hex dump of the wallet.dat file
• study the defined file format used by Bitcoin core in 2013
  • perhaps by searching for documentation of the file format.
  • perhaps by studying the source of PyWallet.
  • perhaps by getting a 2013 set of Bitcoin-core's source code from GitHub.
• compare the defined file format with a hex dump of a working wallet.dat of 2013
• make small changes to a working 2013 wallet.dat, make new hex dumps and study the differences.
• compare the defined file format with a hex dump of your damaged wallet.dat
• attempt repair
• perform some forensic recovery process of all data in unallocated space on a bitwise copy of the original computer's hard disk(s) or equivalents. Repeat process on data to try to identify fragments of wallet.dat data.

This would be slow difficult work. You will find differences that don't make sense and you may have to invent new content to insert and also decide what parts to delete. You may need to find tools, or create tools, that allow you to make the changes to a copy of the wallet.dat to repair it. Or you may be able to identify the private keys in the hex dump and just extract those.

If the wallet contains a small amount I wouldn't bother. If it contains an amount equivalent to a years wages say - then, in your shoes, I would probably spend some time on this.

---

There's no safe way to have someone else work on this. It's easy for a stranger to say they found nothing and walk off with your wallet's money. It's easy for conmen to slowly gain your trust until you pay them various fees for working on this for you.