Deleted Bitcoin Core wallet.dat recovered

At first it looked like a dead end: the wallet file had been deleted from the computer and then emptied from the recycle bin — two places, and nothing left in either. The client still had the account context and knew roughly when the deletion had happened. That timing turned out to matter more than anything else.

Deleting a file does not erase it

When you delete a file, the operating system removes the directory entry that points to it and marks its blocks as available. It does not go and scrub those blocks. On a traditional hard drive the data remains physically present — as magnetic flux on the platters — until something else is written over it.

That is the entire window recovery works in, and it closes as the drive gets used. Every download, every update, every temporary file is a chance for the operating system to reuse exactly the blocks your wallet used to occupy.

This drive had been used sparingly since the deletion. That is the reason this case succeeded.

The SSD exception, stated honestly

The picture is very different on modern solid-state drives, and it would be dishonest to describe this case without saying so.

When a file is deleted on an SSD, the operating system typically issues a TRIM command telling the drive's controller that those blocks are no longer in use. Background garbage collection then erases the underlying NAND cells. Once that has happened, recovery becomes difficult or impossible — the exact outcome depends on the drive's firmware, but it is not something to count on.

TRIM is also not universal. It requires both the drive to support it and the operating system to ask for it, and there are real gaps: Windows does not issue TRIM on FAT32 or exFAT volumes, most hardware RAID controllers do not pass it through, many external drives connected over USB never receive it, and older SSDs predating the command ignore it entirely. A wallet sitting on any of those may still be recoverable.

These are exceptions to check, not to rely on.

The practical rule is the same either way, and it is urgent: stop using the device the moment you notice the deletion. Do not install recovery software onto the affected drive — that alone can overwrite what you are trying to save.

What we did

We imaged the drive first, to freeze its state and guarantee that nothing we did could make matters worse. All work then happened on that image; the original was never written to.

From the image we carved the deleted wallet.dat out of unallocated space. A legacy Bitcoin Core wallet is a Berkeley DB file with recognizable structure, which is what makes it identifiable among raw blocks rather than just an anonymous run of bytes. (Newer descriptor wallets use SQLite instead, the default since Bitcoin Core v23 — a different structure, but the same principle.)

With the file reconstructed, restoring access was routine.

What would have made this case impossible

• Continued heavy use of the drive. Days of normal computer use after a deletion usually ends the case.
• An SSD that had TRIMmed the blocks. Recovery is not slower in that situation; it is over.
• Running recovery tools on the affected drive. The most common way people destroy their own recoverable data.
• A reformat with a full (non-quick) format, or a drive that has since been encrypted.

What this means if you are in the same position

Power the machine down. Do not "have a quick look." Do not install anything. If the wallet mattered, the drive is now evidence, and the correct first action is to preserve it rather than investigate it.

Preservation beats every recovery tool. See the safety & forensics reference and the wallet formats guide.