Owner safety guide

Found an old hard drive with Bitcoin? What to do before you touch it

For old or legacy wallet recovery, the first priority is not guessing. It is preserving every artifact that could contain keys, metadata, or clues—from Electrum wallet files and MetaMask vault data to Ethereum keystores and encrypted Core-wallet backups.

Make a non-destructive inventory

Record wallet software, cryptocurrency, approximate year, device and operating system, filenames, backup media, wallet addresses, old emails, handwritten notes, hardware devices, and every recovery attempt already made.

Protect originals

Disconnect failing media where practical and seek qualified data-recovery help if a disk is physically unstable. Create verified copies or disk images before analysis. Preserve timestamps and keep a simple chain-of-custody note describing each copy.

Separate three different problems

Password recovery starts with an intact encrypted wallet. Data recovery tries to retrieve a missing or damaged file. Missing-key loss means no private-key-bearing material is known to remain. These problems have very different prospects and should not be marketed as equivalent.

Document memory without revealing secrets

Write down approximate password structure, languages, substitutions, date associations, likely length, and where the password may have been recorded. Keep actual passwords, seed words, private keys, and recovery codes offline and private.

Expect an honest “not feasible”

Strong encryption, insufficient clues, overwritten media, or absent key material can make recovery unrealistic. A legitimate service should explain this and should not promise success.

HDD and SSD recovery are not the same

Deleted sectors on a magnetic hard drive may sometimes remain until overwritten. SSD garbage collection and TRIM can make deleted wallet data unrecoverable even when the computer still works. A failing device should be imaged by an appropriate data-recovery specialist before wallet analysis begins.

Separate data recovery from password recovery

Finding a readable wallet file is one problem; unlocking an encrypted wallet is another. If the preserved material is a Core file, review the Bitcoin Core wallet.dat password recovery guide. For a legacy web-wallet export, see the Blockchain.info wallet.aes.json password recovery guide. KeyBack's initial feasibility assessment is free. If preserved wallet material supports a realistic attempt, authorization, handling safeguards, and success-fee terms are agreed before work. No outcome is guaranteed.

Recovery-scam warning

Avoid uploading disk images or wallet files to unknown websites. Never send a seed phrase, private key, full password, or wallet file in ordinary email. Claims that a service can recover Bitcoin from only a public address, reverse a transaction, or guarantee success are warning signs.

Frequently asked questions

Should I run CHKDSK or fsck on the old drive?

Not on the only copy. Repair tools write to the filesystem and can change evidence. Preserve or image the device first.

Can deleted wallet data always be recovered?

No. Overwriting, SSD TRIM, physical damage, and the absence of usable wallet material can make recovery impossible.