7 ms·

Doesn't work for Bitcoin Wallet on Android :-( I lost some Bitcoins on an old phone that used Bitcoin Wallet (https://github.com/schildbach/bitcoin-wallet http

Doesn't work for Bitcoin Wallet on Android :-( I lost some Bitcoins on an old phone that used Bitcoin Wallet (https://github.com/schildbach/bitcoin-wallet https://github.com/schildbach/bitcoin-wallet) by doing "Settings > Reset". I tried using this app to find them by dumping the /data partition, but no luck. Apparently it uses a different wallet format: The wallet file format is not compatible to wallet.dat (Satoshi client). Rather, it uses a custom protobuf format which should be compatible between clients using bitcoinj. Any ideas on how to find such coins?

sillysaurus2 13y ago
I like a good challenge. Would you send me a dump of the phone's harddrive? The command to dump the harddrive is `dd if=/dev/hda1 of=./phone.image` Then I'll examine the bitcoinj wallet format and write a tool to search for the private key within the phone.image file. My email's in my profile.
- ge0rg 13y ago
  Haha, this is a nice try :D
romaniv 13y ago
I lost some Bitcoins on an old phone that used Bitcoin Wallet (https://github.com/schildbach/bitcoin-wallet https://github.com/schildbach/bitcoin-wallet) by doing "Settings > Reset". That sounds like remarkably horrible UI design. Being purely digital and having no institutional overhead, Bitcoin seems to "uncover" a lot of security and design problem in modern apps.
- graemian 13y ago
  It was an Android "Settings > Reset", not from within the app
ansible 13y ago
It may have made a new filesystem and written that to your NAND Flash or eMMC drive partition. So the filesystem itself won't contain any old data. Depending on the type of filesystem used, it may have walked through all the blocks of the NAND Flash, erased them, and then marked them as 'ready for use'. If you are very serious about this, your best bet is to (A) stop using the phone now, (B) dump the raw partition contents using the Android tools. The situation might be better or worse if the phone uses eMMC, but the above holds. The chip itself does the Flash management (wear leveling, bad block detection, etc.). So it can hide more, but there may be leftover data from the old /data partition still in the unused blocks.
- graemian 13y ago
  I'd love to know if the partition was completely wiped as you describe. It's a Galaxy S2 running Android 4.0.4. It's the /data partition on the internal storage, I think. How would I find out?
mrb 13y ago
I wrote a tool one day (during a long car ride :D) to recover keys from Bitcoin Wallet on Android. It consists of searching for the header of the wallet-protobuf file (always starts with "\x0a\x16org.bitcoin.production") and then parsing the protobuf data. Once the 256-bit private ECDSA keys were dumped in hex, I didn't even bother finding/writing a converter to WIF format. I just used brainwallet.org for that purpose (pasting the value in "secret exponent", and making sure to select "compressed" as Bitcoin Wallet creates compressed pub keys), then imported the WIF into a local bitcoind instance.

sillysaurus2 13y ago

I like a good challenge. Would you send me a dump of the phone's harddrive? The command to dump the harddrive is `dd if=/dev/hda1 of=./phone.image` Then I'll examine the bitcoinj wallet format and write a tool to search for the private key within the phone.image file. My email's in my profile.

ge0rg 13y ago
Haha, this is a nice try :D

romaniv 13y ago

I lost some Bitcoins on an old phone that used Bitcoin Wallet (https://github.com/schildbach/bitcoin-wallet https://github.com/schildbach/bitcoin-wallet) by doing "Settings > Reset". That sounds like remarkably horrible UI design. Being purely digital and having no institutional overhead, Bitcoin seems to "uncover" a lot of security and design problem in modern apps.

graemian 13y ago
It was an Android "Settings > Reset", not from within the app

ansible 13y ago

It may have made a new filesystem and written that to your NAND Flash or eMMC drive partition. So the filesystem itself won't contain any old data. Depending on the type of filesystem used, it may have walked through all the blocks of the NAND Flash, erased them, and then marked them as 'ready for use'. If you are very serious about this, your best bet is to (A) stop using the phone now, (B) dump the raw partition contents using the Android tools. The situation might be better or worse if the phone uses eMMC, but the above holds. The chip itself does the Flash management (wear leveling, bad block detection, etc.). So it can hide more, but there may be leftover data from the old /data partition still in the unused blocks.

graemian 13y ago
I'd love to know if the partition was completely wiped as you describe. It's a Galaxy S2 running Android 4.0.4. It's the /data partition on the internal storage, I think. How would I find out?

mrb 13y ago

I wrote a tool one day (during a long car ride :D) to recover keys from Bitcoin Wallet on Android. It consists of searching for the header of the wallet-protobuf file (always starts with "\x0a\x16org.bitcoin.production") and then parsing the protobuf data. Once the 256-bit private ECDSA keys were dumped in hex, I didn't even bother finding/writing a converter to WIF format. I just used brainwallet.org for that purpose (pasting the value in "secret exponent", and making sure to select "compressed" as Bitcoin Wallet creates compressed pub keys), then imported the WIF into a local bitcoind instance.