2013-2017 Bitcoin Wallet Recovery Checklist

Every recovery service operator has stories: someone finds a 2014 hard drive in a moving box, plugs it in, finds a long-forgotten wallet.dat with 5 BTC. After password recovery, that one weekend pays for a year of life. This page is the systematic checklist for where to look and what to do when you find something.

Step 1 — search every storage location

• Old laptop / desktop hard drives (USB-to-SATA adapters: $15)
• External backup drives, USB sticks, SD cards
• Email attachments (search "wallet", "backup", "bitcoin", ".dat", ".key")
• Dropbox / Google Drive / iCloud — check trash and revision history
• Old phone backups (iTunes, Google Drive Android backups)
• Time Machine snapshots (macOS) and File History (Windows)
• Burnt CDs / DVDs from 2013-2015
• Friends or family who might have helped you set up the wallet

Step 2 — file format detection

Step 3 — file locations on disk

# Bitcoin Core / Bitcoin-Qt
Windows:  %APPDATA%\Bitcoin\wallet.dat
macOS:    ~/Library/Application Support/Bitcoin/wallet.dat
Linux:    ~/.bitcoin/wallet.dat

# Multibit Classic (2013-2016)
Windows:  %APPDATA%\MultiBit\multibit.wallet
macOS:    ~/Library/Application Support/MultiBit/multibit.wallet
Linux:    ~/.multibit/multibit.wallet

# Multibit HD (2014-2017)
Windows:  %APPDATA%\MultiBitHD\mbhd-*\mbhd.wallet.aes
macOS:    ~/Library/Application Support/MultiBitHD/mbhd-*/mbhd.wallet.aes

# Armory
Windows:  %APPDATA%\Armory\armory_*.wallet
macOS:    ~/Library/Application Support/Armory/armory_*.wallet

# Electrum (early)
Windows:  %APPDATA%\Electrum\wallets\default_wallet
macOS:    ~/Library/Application Support/Electrum/wallets/default_wallet
Linux:    ~/.electrum/wallets/default_wallet

# Mycelium Android
/data/data/com.mycelium.wallet/files/

# Bitcoin Wallet for Android (Schildbach)
/data/data/de.schildbach.wallet/files/wallet-protobuf

# Breadwallet / Bread iOS
App container Documents/wallet.bin (encrypted iTunes backup)

# Coinbase old desktop wallet (2013)
Pre-2014 emailed PDF / CSV backups - search inbox

Step 4 — Bitcoin Core wallet.dat extraction

# Convert wallet.dat to hashcat hash (mode 11300)
python3 bitcoin2john.py wallet.dat > wallet.hash

# Mask attack: you remember it's 8 chars, lowercase + digits
hashcat -m 11300 -a 3 wallet.hash --increment --increment-min 6 --increment-max 10 "?l?l?l?l?l?l?l?l?l?l"

# Dictionary + best64 rules (catches 30-50% of cases)
hashcat -m 11300 -a 0 wallet.hash rockyou.txt -r best64.rule

# btcrecover with tokenlist (best for 'mostly remembered' passwords)
python3 btcrecover.py \
    --wallet wallet.dat \
    --tokenlist tokens.txt \
    --typos 3 --typos-case --typos-swap --typos-repeat --typos-delete

# After recovery, import into modern Bitcoin Core or sweep with Electrum

Step 5 — Multibit Classic special handling

Multibit Classic stopped working in 2017 — it relied on hardcoded Insight API endpoints that have been shut down. The .key files contain individual private keys in WIF format. The recovery path:

1. Extract individual .key files from ~/.multibit/ or backup
2. Each line is a WIF private key (starts with K, L, or 5)
3. Import into Electrum: File → New → Import private keys
4. Or sweep using a hardware wallet that supports key import

Multibit HD mbhd.wallet.aes is encrypted with AES-256-CBC + scrypt. btcrecover supports it directly: btcrecover --wallet-type multibithd.

Step 6 — blockchain.info / blockchain.com backups

# blockchain.info wallet.aes.json structure
{
  "version": 3,
  "iv": "...",
  "iterations": 5000,    # KDF iter (was 10 in early 2013!)
  "payload": "..."       # AES-encrypted JSON of keys + metadata
}

# btcrecover Blockchain.info module
python3 btcrecover.py \
    --wallet wallet.aes.json \
    --wallet-type blockchain \
    --tokenlist tokens.txt \
    --typos 3

# Modern import: blockchain.com no longer accepts .aes.json directly.
# Decrypt, extract keys, import to Electrum.

Recovery feasibility scorecard

Pro tips from operators

• Image the drive first (dd / FTK Imager) before touching anything — single-attempt errors can corrupt LevelDB.
• If the drive has bad sectors, run PhotoRec on a forensic image, not the live drive.
• Many people used the SAME password across crypto + email accounts in 2013. Try password manager exports from old accounts.
• Check `recovery-utility` deleted-file scans on cloud storage — Dropbox / Google Drive keep ~30-365 days of revision history.
• If your wallet had a non-zero balance you remember, look up the address on a block explorer to confirm — sometimes funds were already moved without your memory.

Related guides

• Bitcoin Core wallet.dat deep dive.
• Electrum recovery.
• Jaxx Liberty (multi-asset legacy).
• Paper wallet sweep / import.

Frequently asked questions