Corrupted 2013 wallet.dat Recovery via Community-Guided Disk Scanning
SurvivedHardware device was lost or destroyed — an independent backup existed and access was restored.
In December 2017, a macOS Bitcoin Core user attempted to restore access to two wallet.dat files created in late 2013. The user had downloaded a contemporary version of Bitcoin Core and attempted to replace the auto-generated wallet with the old files, but Bitcoin Core returned a 'corrupted unable to recover' error. The salvage feature, normally designed for minor corruption, proved ineffective even when tested on known good 2013 wallet files.
The user initially assumed the wallets were unencrypted and pursued multiple technical avenues: pywallet extraction with Python returned 'wallet data not recognized' errors and parsing failures; hex editor searches for known private key patterns (keyA prefixes and Berkeley DB signatures like fd1701308201130201010420) yielded either no results or excessive false positives; repeated attempts to load the files through Bitcoin Core's native interface consistently failed.
The BitcoinTalk community response was extensive and methodical. User sgravina recommended wallet-recover, a byte-by-byte disk scanning tool. User Shirase provided detailed hex editor methodology and authored a comprehensive step-by-step guide for creating a Linux Live USB, booting Ubuntu, running wallet-recover to scan for private keys, and securely transferring recovered data back to macOS. Spendulus advised testing on known-good 2013 wallet files first. User Butense offered live-chat assistance and recommended wallet-key-tool (a .jar GUI application) and alternative pywallet versions from pastebin.
On January 2, 2018, the user reported successful recovery via an external third-party service using methods discussed in the original wallet-recover thread. Full access was restored. The user pledged donations to sgravina and Shirase and marked the thread '[Solved].' The specific Bitcoin amount recovered was not disclosed.
| Stress condition | Device loss |
| Custody system | Software wallet |
| Outcome | Survived |
| Documentation | Present and interpretable |
| Year observed | 2017 |
| Country | United States |
What determines whether device loss is permanent
When a device fails, burns, floods, or disappears, the Bitcoin remains on the blockchain, unchanged. What changes is whether any path to authorized access still exists. A seed phrase stored separately from the device preserves that path. A seed phrase stored with the device — or never recorded at all — eliminates it permanently.
The pattern observed across cases in this archive is consistent: recovery is possible when the seed phrase survived the event that took the device. It is not possible when it did not. The type of device, its cost, its brand, its security features — none of these factors determine the outcome. The seed phrase backup does.
Most device loss cases that result in permanent loss involve one of three failure modes: the seed phrase was never recorded at setup, the seed phrase was stored physically alongside the device and lost with it, or the seed phrase was stored in a location that became inaccessible during the same event (flood, fire, relocation). All three are detectable in advance. A backup test — confirming that the seed phrase can restore the wallet on a separate device — would have revealed the gap before the loss event.
A device loss case becomes unrecoverable the moment the backup path is also broken. The preventive action is simple in concept: record the seed phrase at setup, store it independently from the device, and test that it works. Most cases in this archive involved none of these three steps.
Translate