The situation

The client remembered running Bitcoin Core on an old PC, then deleting the wallet and, later, the drive itself failing. They shipped the drive to our lab as a last resort.

The challenge

Two problems stacked: the drive wouldn’t mount reliably, and the wallet file had been deleted. But on a hard drive, deleted data usually survives until it’s overwritten — so if the platters were readable, the wallet.dat was likely still recoverable in the free space.

How we recovered it

We took a forensic image of the failing drive to work from a stable copy, then scanned the entire image with pywallet to carve out wallet.dat fragments and stray private keys. With the wallet file reconstructed, a hint-driven search recovered the password and unlocked it.

The outcome

The client’s Bitcoin was moved to a new wallet, off the old media entirely. Success-based fee, nothing upfront. Note: on SSDs the TRIM command can permanently erase deleted data, so results vary by media — we assess each device first.

Have a similar case?

Deleted a wallet or have a drive that won’t boot? On a hard drive, it’s often still there. Related: Dead hard drive recovery · Broken phone recovery