Hacker News Reader

Comment by graemian | Hacker News Reader

Doesn't work for Bitcoin Wallet on Android :-(

I lost some Bitcoins on an old phone that used Bitcoin Wallet (https://github.com/schildbach/bitcoin-wallet) by doing "Settings > Reset".

I tried using this app to find them by dumping the /data partition, but no luck. Apparently it uses a different wallet format:

The wallet file format is not compatible to wallet.dat (Satoshi client). Rather, it uses a custom protobuf format which should be compatible between clients using bitcoinj.

Any ideas on how to find such coins?

View on HN

I like a good challenge. Would you send me a dump of the phone's harddrive? The command to dump the harddrive is `dd if=/dev/hda1 of=./phone.image`

Then I'll examine the bitcoinj wallet format and write a tool to search for the private key within the phone.image file.

My email's in my profile.

Haha, this is a nice try :D

It may have made a new filesystem and written that to your NAND Flash or eMMC drive partition. So the filesystem itself won't contain any old data.

Depending on the type of filesystem used, it may have walked through all the blocks of the NAND Flash, erased them, and then marked them as 'ready for use'.

If you are very serious about this, your best bet is to (A) stop using the phone now, (B) dump the raw partition contents using the Android tools.

The situation might be better or worse if the phone uses eMMC, but the above holds. The chip itself does the Flash management (wear leveling, bad block detection, etc.). So it can hide more, but there may be leftover data from the old /data partition still in the unused blocks.

I'd love to know if the partition was completely wiped as you describe. It's a Galaxy S2 running Android 4.0.4. It's the /data partition on the internal storage, I think.

How would I find out?

I wrote a tool one day (during a long car ride :D) to recover keys from Bitcoin Wallet on Android. It consists of searching for the header of the wallet-protobuf file (always starts with "\x0a\x16org.bitcoin.production") and then parsing the protobuf data.

Once the 256-bit private ECDSA keys were dumped in hex, I didn't even bother finding/writing a converter to WIF format. I just used brainwallet.org for that purpose (pasting the value in "secret exponent", and making sure to select "compressed" as Bitcoin Wallet creates compressed pub keys), then imported the WIF into a local bitcoind instance.

I lost some Bitcoins on an old phone that used Bitcoin Wallet (https://github.com/schildbach/bitcoin-wallet) by doing "Settings > Reset".

That sounds like remarkably horrible UI design.

Being purely digital and having no institutional overhead, Bitcoin seems to "uncover" a lot of security and design problem in modern apps.

It was an Android "Settings > Reset", not from within the app

Reply on news.ycombinator.com