Bitcoin Core Wallet Recovery (wallet.dat)

wallet.dat is Bitcoin Core's wallet: the private keys and transaction records for your coins. Litecoin, Dogecoin and Bitcoin Cash Core wallets share the same format. Modern versions are SQLite databases; wallets from before roughly 2021, and legacy wallets in current versions, are Berkeley DB files.

It lives in the Bitcoin data directory: %APPDATA%\Bitcoin on Windows, ~/Library/Application Support/Bitcoin on macOS, ~/.bitcoin on Linux, in a wallets/ subfolder on newer versions. It is typically tens to a few hundred kilobytes, which is a useful size signal when sifting recovered files.

Usually not. That message means Bitcoin Core's own salvage routine could not repair the database structure. It does not mean the private keys inside are damaged, and it is not the last word.

Keys can be extracted directly from a damaged file, including keys the wallet software can no longer see, by reading the byte patterns rather than asking the database to open. Copy the file first and stop letting Bitcoin Core write to it. The free walkthrough is in the corrupt or deleted Bitcoin Core wallet guide.

Sometimes, and what decides it is your memory rather than the hardware. Bitcoin Core encryption is deliberately slow to attack, so blind brute force against a strong password is hopeless no matter what GPUs are pointed at it.

What works is a targeted search built from what you actually remember: the era, the length, the words you used then, capitalisation habits, substitutions, endings, and anything reused from other accounts of that time. A person who says "it was probably one of about five things with a number after it" has a far better case than one who remembers nothing about a shorter password.

Check the obvious things first: the node may still be syncing, or you may be looking at a wallet from before you moved the coins. After that, the classic cause on old wallets is the key pool. Pre-2013 Bitcoin Core kept a limited pool of pre-generated keys, and a backup taken before change addresses were generated can be missing the keys that hold your change.

An empty-but-should-be-full restore is almost always a lookup or key-pool problem rather than a lost-coins problem.

It depends almost entirely on the drive. On a spinning hard drive a deleted wallet often survives for years and carving recovers it routinely. On a TRIM-enabled SSD the blocks are usually erased within minutes and no software will get them back.

Either way, stop writing to that drive now, before you do anything else, and do not install recovery software onto it. See what to do in the first hour.

No, and no legitimate service should ask for it up front. The first assessment runs on a description: what the file is, what error you see, roughly when the wallet was made, and what you remember about the password. Only after there is a written contract does anything secret change hands, and then over an encrypted channel of your choosing. Here is exactly what happens to your wallet file once you send it, from transfer through to destruction.

The assessment is free and there is no fee unless the recovery succeeds. When it does, the published rate is 15% of the recovered amount under 100 BTC, and 10% above that. Full pricing is on the homepage, and the terms are in a written contract before any work starts.