Found an Old 2010 Bitcoin Wallet, Need Help!

Hey everyone I just got my old HDD running and found this wallet.dat from 2010. It shouldn’t be encrypted, but I ended up deleting it since I forgot I even mined BTC back then. Now I recovered my wallet but I had already installed Bitcoin Core on the same HDD and downloaded the blockchain on another drive. The properties say it was created in 2021 but modified in 2010. Could it be overwritten? Before recovering, I opened it in a text editor and it was readable as wallet.old. Kinda confused here.

If your wallet.dat isn’t encrypted, you don’t need any recovery words to access it.

Wait, you found the old HDD and deleted wallet.dat? Then you got it back? So you installed Bitcoin Core and now you have two wallet.dat files? One you recovered and one created by the new install? What’s the actual situation?

Exactly, you should stop using that drive immediately. Remove the HDD and clone it using a tool like dd without mounting. The longer you use it, the more chance you lose your data. You might not need the clone, but better safe than sorry!

I don’t think brainwallets were a thing back then. I first heard about them in late 2011.

Anyone happen to have a wallet file from 2010? I mined BTC back in the day but formatted my HD. Just found it again and need to recover the deleted file using Winhex. I’ll reward someone if they help me out.

You can try using pywallet. It might help you with recovery.

Just a heads up, the wallet.dat should be a backup or newly created with the old versions. If it’s an old backup loaded into a newer version, the format may have changed.

If you can't build it from source, I’m working on a project that might help.

So I formatted this HDD multiple times and used it for years. Thought I lost it until I found it in a box. Tried searching for hex string "fd1701308201130201010420" but no luck. Does that prefix apply to wallets from 2010?

I really hope you’re working on a disk image instead of using the original drive. I have a test wallet.dat from v0.1.3 with magic number 0x01130201010420, but it only has two keys. Search for 0x0201010420 for more results.

Great info, but don’t take my comment wrong, your wallet actually does match that 12-byte pattern you mentioned.

Formatting these days often just clears old structures without overwriting file contents. But if it was done on a self-encrypting device, you’re in trouble.

I welcome any nitpicks, especially if they clear up confusion.

That prefix indicates an unencrypted wallet. Yours might be encrypted. Hard to tell when that feature was added to the client.

Did some research on that. Wallet encryption started in version 0.4.0. The previous version 0.3.24 didn’t have it.

Thanks, I found that out already. But identifying the wallet header can still be useful to me.