Corrupted Bitcoin QT wallet.dat: Undelete and Hex Editor Recovery Attempt
IndeterminateHardware device was lost or destroyed — whether access was recovered is not documented.
In March 2017, a Bitcoin user identified as Sammo619 described a custody failure involving a Bitcoin QT Core wallet created in 2014. All backups of the wallet.dat file had been lost over the intervening years. The original hard drive retained traces of the file in unallocated sectors, and Sammo619 successfully used freely available undelete software to locate the deleted file, but standard recovery tools proved insufficient to restore it to a usable state.
Sammo619 contacted specialist data recovery companies, who expressed low confidence in successful recovery. The user possessed electrical engineering expertise but lacked the software coding knowledge required to deploy automated recovery tools such as pywallet.py. However, Sammo619 had access to a hex editor and took the precaution of mounting the original hard drive as a secondary device on a Windows 10 system to avoid further corruption during recovery attempts.
The encryption status of the wallet was uncertain. Sammo619 believed a passphrase may have been set during wallet creation but felt confident in guessing probable passphrases if the file could be recovered.
Community response on the Bitcoin Technical Support forum provided detailed technical guidance. Experienced user HI-TEC99 offered step-by-step instructions for sector-by-sector hex editor searches targeting specific Bitcoin private key byte sequences (searching for the pattern '01 03 6B 65 79 41 04' followed by '04 20' markers approximately 180 bytes later). The thread referenced earlier recovery work by Casascius on corrupted wallet files.
Sammo619 indicated willingness to pursue these manual recovery methods. The visible forum thread contains no documented outcome, and the recovery status—whether any Bitcoin was successfully retrieved—remains unknown.
| Stress condition | Device loss |
| Custody system | Software wallet |
| Outcome | Indeterminate |
| Documentation | Partial |
| Year observed | 2017 |
What determines whether device loss is permanent
When a device fails, burns, floods, or disappears, the Bitcoin remains on the blockchain, unchanged. What changes is whether any path to authorized access still exists. A seed phrase stored separately from the device preserves that path. A seed phrase stored with the device — or never recorded at all — eliminates it permanently.
The pattern observed across cases in this archive is consistent: recovery is possible when the seed phrase survived the event that took the device. It is not possible when it did not. The type of device, its cost, its brand, its security features — none of these factors determine the outcome. The seed phrase backup does.
Most device loss cases that result in permanent loss involve one of three failure modes: the seed phrase was never recorded at setup, the seed phrase was stored physically alongside the device and lost with it, or the seed phrase was stored in a location that became inaccessible during the same event (flood, fire, relocation). All three are detectable in advance. A backup test — confirming that the seed phrase can restore the wallet on a separate device — would have revealed the gap before the loss event.
A device loss case becomes unrecoverable the moment the backup path is also broken. The preventive action is simple in concept: record the seed phrase at setup, store it independently from the device, and test that it works. Most cases in this archive involved none of these three steps.
Translate