{"id":25703450,"url":"https://github.com/dashpay/key_finder","last_synced_at":"2025-02-25T05:29:43.142Z","repository":{"id":19969252,"uuid":"23236247","full_name":"dashpay/key_finder","owner":"dashpay","description":"Scalpel config and ruby script to recover bitcoins and others","archived":false,"fork":false,"pushed_at":"2014-08-22T18:58:33.000Z","size":95,"stargazers_count":7,"open_issues_count":0,"forks_count":13,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-04-13T03:30:58.378Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dashpay.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-08-22T18:55:28.000Z","updated_at":"2024-01-13T01:41:12.000Z","dependencies_parsed_at":"2022-08-21T15:21:05.823Z","dependency_job_id":null,"html_url":"https://github.com/dashpay/key_finder","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashpay%2Fkey_finder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashpay%2Fkey_finder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashpay%2Fkey_finder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashpay%2Fkey_finder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dashpay","download_url":"https://codeload.github.com/dashpay/key_finder/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240610912,"owners_count":19828891,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-02-25T05:29:41.841Z","updated_at":"2025-02-25T05:29:43.077Z","avatar_url":"https://github.com/dashpay.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"Recover Private Keys From Deleted Wallet Files\n====================\n\nIn this guide we will use scalpel and a custom ruby script and gem to recover lost private keys from deleted wallet files. The first step when deciding to attempt to recover private keys from a lost wallet file is to determine which public addresses holds the coins you are interested in recovering. Once you determine this you can then attempt to extract all the private keys on a drive iterate through each private key, compute the public key and determine it if is the key you are looking for.\n\nInstall And Setup Scalpel\n---------------------\n\nInstall scalpel via your package manager and open the config file:\n\n    vim /etc/scalpel/scalpel.conf\n\nBy analyzing the wallet.dat files of Darkcoin I was able to determine that private keys are always surrounded by the following hex values. I only have found Darkcoin and Bitcoin, if you end up adding more please issue a pull request as it could be helpful for others.\n\nAdding this line to your scalpel config will allow us to extract private keys from the drive:\n\nBITCOIN\n\n    key     y       128  \\x01\\x01\\x04\\x20                   \\xa0\\x81\\x85\\x30\\x81\\x82\\x02\\x01                 \n\nDARKCOIN\n\n    key     y       128  \\xd7\\x00\\x01\\xd6\\x30\\x81\\xd3\\x02\\x01\\x01\\x04\\x20                   \\xa0\\x81\\x85\\x30\\x81\\x82\\x02\\x01\\x01\\x30\\x2c\\x06\\x07\\x2a\\x86\\x48\n\nUncomment this line while leaving all the other options commented out. \n\nDetermine which drive you lost the keys \n\n    df -h \n\nFind the drive your wallet was stored on. My primary partition is /dev/sdb1, so I will run the scalpel against that drive. Use the -o (output) flag to specify your output directory.\n\n    mkdir ~/keys \u0026\u0026 scalpel /dev/sdb1 -o output ~/keys\n\nTar these files and scp them to a separate computer for analysis\n\n    tar -cvf keys.tar.gz ~/potential_keys/\n    scp keys.tar.gz user@otherserver\n\nAnalysis Of Scalpel Output\n---------------------\n\nTo make the process easier I had cuztomed the bitcoin-ruby gem for a friend and added support for Darkcoin. I also modified it to allow easy output for compressed keys (the common version of the key). Add this to your gemfile:\n\n    gem \"bitcoin-ruby\", :git =\u003e \"https://github.com/chemicalfire/bitcoin-ruby.git\"\n\nFirst the provided script will extract the keys from the scalpel output to make it easier to analyze. By default it expects the folder for the scalpel output to be named \"output\" but you can modify the constant DIR at the top of the file to specify your own folder name. \n\n    DIR = \"keys\"\n\nThen you will also want to set your public key you determined is holding the funds you are interested in looking for\n\n    PUBKEY = \"1NB6BCRctsjneowskMQM7Djx5GAkC9yBmy\"\n\nThen finally if you are searching darkcoins change this option to darkcoin otherwise leave it as bitcoin.\n\n    COIN = \"bitcoin\"\n\nOnce all these settings are defined you can then run the key_finder.rb script and see if your private key was found by scalpel:\n\n    bundle exec ruby key_finder.rb\n\nIf the script runs successfully, you will see it parse each key and it will end with the number of keys available readied for testing:\n\n\t\t\"Potential keys to test: 9943\"\n\nIt will then begin to load each private key and determine both the uncompressed and compressed versions of the key. \n\nIf it succeeds in locating the key it will give you both a hex and base58 version of the key otherwise you will be prompted that the key was not found. \n\nDonations\n---------------------\n\nI created this to help others and I believe in free open source code so I don't expect to be paid, but if you are able to recover funds and are feeling generous, I accept donations. \n\nI lost 0.24 bitcoins and unfortunately was not able to recover them, and my significant other 20 lost I gifted to them in aencrypted wallet. \n\nI was able to recover 10,000 lost Darkcoins using this method though and was grateful it worked and wanted to share my methods with others. \n\n1NFk9ukkUw6w5oQ7JtaPPr2MpyQ7RkiQXC\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdashpay%2Fkey_finder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdashpay%2Fkey_finder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdashpay%2Fkey_finder/lists"}