Q:

Filesystem is corrupt. How to find wallet.dat?

A customer of mine brought me a 2TB crashed harddrive. The drive itself is not damaged physically, but the file tables (MFT / NTFS) are corrupt so there is zero ability to recover files with their original names.
The contents of the drive is not important, except for the customer's wallet.dat file which contains "a substantial amount of bitcoins" (sic).
Finding this file among 2TB of data is pretty much a needle in a haystack.
So, question: Does wallet.dat contain anything unique, anything that can be binary searched for, anything that makes it say "hey, I'm wallet.dat!"?

A:

It has magic bytes plus a version number at byte 12 in the file:
00000000 [00 00 00 00 01 00 00 00] [00 00 00 00] [62 31 05 00]
                     ^ lsn               ^ page num    ^ magic
00000010 [09 00 00 00] [00 20 00 00] 00 [09] 00 00 00 00 00 00
               ^ version     ^ page size  ^ db type

Searching for 62 31 05 00 09 00 00 00 should get you what you're looking for.
Source: berkleydb source code: layout, magic number
If that doesn't work, there are a couple of patterns you might find handy:

00 01 07 6b 65 79 6d 65 74 61 (keymeta)
00 01 0a 64 65 66 61 75 6c 74 6b 65 79 (defaultkey)
00 01 0a 6d 69 6e 76 65 72 73 69 6f 6e (minversion)
00 01 09 62 65 73 74 62 6c 6f 63 6b (bestblock)
00 01 03 61 63 63 (acc) Account
00 01 03 6b 65 79 (key)
00 01 04 63 6b 65 79 (ckey) Encrypted key
00 01 04 6d 6b 65 79 (mkey) (Only in encrypted wallets)
00 01 04 6e 61 6d 65 (name)
00 01 07 70 75 72 70 6f 73 65 (purpose)

There's a list of the tokens it uses in this source file, and you can see an explanation of what they correspond to here.

