Data Recovery Case File · Solid State & Flash · The Wallet in the Netbook

"I only need to recover that wallet" — one small file, soldered storage, a recent history of space-clearing deletions: the hunt run on the image, the honest limits stated, and custody kept where it belongs

Her enquiry laid out a problem this trade meets more often as the years pass. The machine: "an old ASUS Transformer Book, 10.1-inch, 2GB RAM on Windows 8 — completely dead. Can't switch it on." The prelude to the death: "before it went dead I couldn't run it any more — disk capacity was full. I tried to remove a few files I thought I was not using, so it was a mess anyway." The target: "a Classic Multibit wallet for Bitcoin. I only need to recover that wallet / private keys." Her two framings of success — revive the machine so she can use the wallet as before, or extract the wallet so she can use it again elsewhere — get their practical answer below. But this genre demands its ground rules stated before its techniques, so here they are, up front: a laboratory recovers files; the wallet file and the keys inside it are the owner's alone; nothing about this work involves anyone else holding, seeing, or ever being able to use what those keys unlock. That framing isn't caution for its own sake — it is the entire difference between a recovery service and a risk.

The decode: soldered storage, the deletion risk, and how a wallet hunt works

The netbook's anatomy: small convertibles of this generation carry their storage soldered to the mainboard — no drive to slide out and read elsewhere. When the board dies, the data doesn't, but reaching it means either reviving the board's power side or reading the embedded memory directly at chip level, through the service techniques this bench keeps for exactly these machines. Her first framing — repair the netbook and use it as before — was answered honestly: possible sometimes, but the machine's economics and age argue against it, and more importantly her second framing is the robust one: get the wallet out, into a current, maintained wallet application, where it should have been living anyway.

The deletions, faced squarely: the tense passage in her account is the space-clearing — files removed under pressure, judged unneeded, on a machine whose real treasure was one obscure file most owners wouldn't recognise by name. Two mercies stood on her side: wallet files live in tucked-away application folders, not the documents and downloads a space-clearer culls; and a full disk that then died wrote very little afterward, so even a deleted file's territory likely survived unclaimed. The hunt therefore ran both registers from the write-blocked image: the wallet's known paths and filenames first, then a signature sweep of the whole image — wallet files carry recognisable internal structure — covering the live filesystem and the deleted remains alike. And the honest limit, stated as this genre requires: keys exist nowhere but in that file; a wallet genuinely overwritten is genuinely gone, beyond every laboratory, and any firm implying otherwise about lost keys is selling something other than recovery.

Custody, as practised: the wallet was located intact in its application folder — never among her deletions — and verified the only appropriate way: with her, the file's integrity confirmed, opened by her own password, on a machine under her control. Delivery went on encrypted media; working copies were destroyed; and the report's advice was the genre's standing order: move the funds with her own hands into a current wallet whose recovery phrase she records properly — on paper, in two places, shown to no one, this laboratory included.

On the bench

Soldered storage means the chip is the patient: the netbook's eMMC was read directly — the Rusolut VNR eMMC toolset and PC-3000 Flash both stand ready for this package type — producing a write-blocked dump of the embedded memory with the dead mainboard bypassed entirely. The hunt then ran in OSForensics: the wallet's known paths and filenames first, then a signature sweep across the whole dump — live filesystem and deleted remains alike — for the wallet format's recognisable internal structure. It surfaced intact in its application folder, was verified with the owner present and her password never shared, and travelled home encrypted. Custody, as the page says, stayed exactly where it belonged.

The outcome

One small file, recovered from a dead machine's soldered memory and returned to the only person entitled to it — her question "is this possible?" answered in the archive's favourite tense, with the safer of her two framings delivered. Free assessment, one fixed written figure including VAT for the work of recovery — never a percentage of what is recovered — with 50% of parts and labour payable upfront where a chip has to be removed, and the balance only on success. The netbook retired; the wallet moved home; the keys, throughout, hers alone.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.