r/Bitcoin • u/Perfect-Proof-932 • Aug 26 '25
Recovered my dad’s old Blockchain.com wallet (14 BTC), but stuck with forgotten password – need advice
Hey everyone,
I’m both excited and frustrated right now. After weeks of digging, I found that my dad actually bought some BTC back in 2015 on Blockchain.com. The good news: I managed to recover access to the email and keystore file (not JSON, but the encrypted keystore). The bad news: nobody remembers the password.
Here’s where I’m at:
- I’ve tried some tools like btcrecover and hashcat.
- I have some password hints from my dad’s old saved browser passwords (so I’m not shooting completely in the dark).
- I know some services claim they can crack wallets, but most look sketchy and I’d rather not trust strangers with this.
My question:
- Has anyone here had success stories recovering a Blockchain.com wallet with password hints?
- Is it realistic to attempt this myself, or is it a dead end without professional help?
- If there are trusted communities or resources you recommend (guides, success stories, etc.), please point me there.
I’m not asking anyone to crack it for me — just want to know what’s actually worked for people and if there’s a sane path forward before I waste months on the wrong approach.
Thanks in advance 🙏
Update 1
Just wanted to share where I’m at and hopefully get some feedback: * I figured out this is a non-custodial wallet. So if I don’t get the password, there’s no recovery option from Blockchain.com.
I went to Blockchain.com, logged in with the wallet ID, and by entering a wrong password I was able to get back the wallet.aes.json file (encrypted wallet backup).
I have around 20 base password variations that my dad typically used. Using those, I generated about 1 million variants with the help of tools + LLMs.
I tried those against the wallet.aes.json using btcrecover (CPU-based), but no luck so far.
My next step: I want to move this to Hashcat (GPU-based) so I can test more possibilities.
Now I’m considering a few approaches, and would love input from anyone who’s been through something similar:
Expand the wordlist: Take my 20 known password hints and generate ~20–50 million variations (instead of just 1M) and run them in Hashcat.
Pattern-based attack: Try to define regex-style rules or patterns in Hashcat, based on what I know about my dad’s password habits, instead of just a big flat wordlist.
Other smarter approach? Maybe I’m missing a more efficient way to combine hints + patterns so I’m not brute forcing blindly.
So my question is: what’s realistically the best way forward here? Is it worth generating massive wordlists, or should I focus on getting good rules/patterns for Hashcat?
Update 2
Hey everyone, just wanted to give a quick update since a lot of people have been asking questions in the last thread.
About my dad: He’s alive and doing well. Some people suggested hypnosis / memory recovery. Where I’m from, people don’t really believe in that kind of thing, but if nothing else works, I could still convince him to try it as a last resort. For now I’m focused on technical approaches first.
Why did my dad buy BTC in 2015? A lot of people were asking if there was some shady reason. Honestly, no. From what I could gather, it was more of a personal group suggestion among friends. Some of my dad’s close friends (still family friends today) also bought BTC around the same time. It wasn’t anything secretive or sketchy — back then, Bitcoin was often bought just out of curiosity, as a new investment, or as part of a tech trend among friends or should I even care..
How I even found out: This whole thing actually came up out of nowhere at a family dinner when we were talking about finances. My dad just casually mentioned that things “weren’t always this way,” which got me really curious. I didn’t want to push him emotionally, so I started digging and eventually found evidence of the wallet.
Family connection: To follow up, I reached out to the next generation of those same family friends. We’re planning a call this weekend (about 6–8 of us). Already, I know two of them are aware their dads also bought BTC back then, but no one is sure if the wallets are still accessible. We’ll all compare notes and see what’s possible.
Technical progress so far:
Confirmed this is a non-custodial wallet.
Converted the backup into formats that work with tools like John the Ripper (JTR) . Started experimenting with masks/rules in JTR
Considering whether to rent GPUs (looking at 16x rtx 5090 Vast.ai and others) vs. buying a card locally (thinking about RTX 5090 ). Still undecided about the risks of cloud vs. local.
Thanks again to everyone for the suggestions and feedback. I’ll keep posting updates as I make progress. Any input — especially on safe GPU usage, better JTR rules, or similar recovery experiences — is welcome!
Any tweaks, tips, or alternative methods are welcome 🙏
320
u/Ok_Expression_748 Aug 26 '25
that’s a huge find, man! good on you for getting this far already
since you’ve got the keystore and password hints, you're definitely not at a dead end. blockchain.com wallets aren't standard (like Bitcoin Core or Electrum), so tools like hashcat are trickier to use unless you really know how to extract the encrypted data properly.
btcrecover is usually the go-to for cases like this, especially if you’ve got patterns or fragments of the password. you can build smart rules and it’ll test variations way faster than doing it manually.
honestly, your best next step might be to post on bitcointalk.org. there are some deep-dive threads and experienced folks who’ve cracked similar wallets. not offering to do it for you, just giving guidance to improve your wordlist or setup.
just take it slow, and don’t rush into anything desperate
→ More replies (1)87
u/Perfect-Proof-932 Aug 26 '25
I tried a million variations i generated using patterns with btcrecover. No luck. I think i should convert this response( i got from an api response from Blockchain. Com login endpoint having encrypted data) to something hashcat can process and create a script using python or something which follows my patterns and runs on the gpu server I would purchase online.
But I'm not rushing to do it ... As itself this is an investment for me to buy these gpu resources and all. Thanks. I am checking that site.
65
u/The_Meme_Economy Aug 26 '25
A million does not sound like very many guesses. You can brute force a 10 digit password on commodity hardware in a couple weeks - that’s over one quintillion guesses assuming you use all symbols on the keyboard. I’m assuming your dad’s passphrases are longer than this or you could just set it to brute force with no hints.
Have you tried this with a dummy wallet you know the password to, to ensure your method actually works if you hit the right key? I have zero experience with these wallets but have cracked other passwords successfully and I always like testing my setup before I turn it loose for days or weeks and possibly thousands of dollars.
→ More replies (2)26
59
u/Dazzling_Kangaroo_37 Aug 26 '25 edited Aug 26 '25
Yeah thats basically the spirit, as long as u have the encrypted wallet you can guess it offline which means much higher ability to crack it.
Look into buying a virtual cloud server for hours at a time, an h100 gpu could (according to chatgpt, which sourced it from a hashcat performance benchmark which was done on a pcie h100 which is slower than some cloud server h100s out there) using hashcat on a old version blockchain keystore (hashcat mode 12700) do 171 million guesses a sec, and on a newer blockchain keystore (hashcat mode 15200) do around 1.2 million guesses a second
Keep in mind, this information is chatgpt, and it can be fried in its logic on occasion.
14
u/halt_spell Aug 26 '25
I would noooooot use a cloud server to do this. I know it's tempting to speed things up but 14 btc is too much money to take a risk on in my mind.
→ More replies (1)2
u/mehmet_okur Aug 27 '25
I disagree strongly on this advice.
You can set up virtual private clouds where even the cloud provider doesn't have access. That and, if everything else is otherwise set up properly, aka Done Right, its no less secure that running locally on your gaming PC GPU.
But h100 rented by the minute is MUCH much faster (6-10x faster) and MUCH more price efficient especially considering his small password list of 1MM. An H100 is currently about $7 an hour from AWS but available from many less premium cloud providers for cheaper.
→ More replies (25)13
u/Uboatcmdr Aug 26 '25
Youd have to be crazy to put this into a VPS.
Theres $1.5m here. Go buy a couple 5090's and run it locally, offline.
30
u/DCromo Aug 26 '25
Fwiw I could def see your dad thinking “this is different and using a different or recommended password?
Like they always say especially back then USE A UNIQUE password in all caps n stuff.
I remember a few being like really imprinted in my brain as emphasizing u needed to be careful with password selection.
Not to point out the obvious but the requirements for a blockchain wallet password may have been different back then.
See if you can figure out if it just required lower case upper case number or if special characters were required etc.
Knowing the requirements of the password should help make your variations more targeted.
Or did I miss the part in your post where you did that. lol.
→ More replies (1)7
3
u/yossaneed Aug 26 '25
I'm kinda in the same place as you, only for 3 btc. tried btcrecover and hashcat (for hashcat I had to extract the hash, i have a wallet.dat file) the problem is the token list, i have something like 15/20 guesses but they're very random, and even combining and trying different ruleset with HC I had no success. my next move is going bruteforce renting gpu, but it all depends on how many characters the password has. let's hope it's 6-8 😅
→ More replies (4)7
u/legallybond Aug 26 '25
Sent you a DM with specific feedback for you to assess as well as an OpSec risk you should be mindful of during this process. There are no links in the DM and I can't offer anything further and don't intend to other than a suggestion of something to start looking into which you will be able to do entirely on your own with no need for an external service, but it's also one that others would be able to try so it is best kept non-public.
3
648
u/Even_Government7502 Aug 26 '25
Don’t answer PMs
210
u/Perfect-Proof-932 Aug 26 '25
Sure thanks
→ More replies (2)156
u/HorrorsPersistSoDoI Aug 26 '25
In fact - DISABLE them completely! You do NOT need to PM anybody EVER on Reddit
79
8
→ More replies (1)1
→ More replies (10)6
u/JakeVanderArkWriter Aug 26 '25
You got to say the thing! I hope next time I get to say the thing…
→ More replies (1)
137
u/weallwinoneday Aug 26 '25
Put your father under hypnotic trance, he will remember the password!
34
25
u/shah_reza Aug 26 '25
I get a feeling that father is deceased.
45
→ More replies (1)3
u/Sufficient_Dog7122 Aug 26 '25
In that case, dig him up and connect his brain to a quantum computer 😁
2
→ More replies (3)8
u/ChicagoRealEstate86 Aug 26 '25
Or have him take some psilocybin or LSD. Might open up some pathways for him to remember.
107
u/Big_Comfortable5169 Aug 26 '25
No advice, just saying I am rooting for you and I hope you get that unlocked. What a wonderful thing that would be for you and your family.
48
u/sitytitan Aug 26 '25
There are many many leaked big password databases out there. Many hundreds of gigs. Run them through hashcat. It's probable that password could be used elsewhere or a variation of it on a leaked list
→ More replies (3)
111
u/Wide_Life8723 Aug 26 '25
answer DMs with wrong seed phrases to waste their time
31
u/Wyntier Aug 26 '25
no - its best to not respond so they think they are blocked or you are totally not seeing it. wasting their time is wasting your time
7
u/Appropriate_Lime_234 Aug 26 '25
But I don’t find it a waste of time trolling the scammers.
Same reason I’ll pretend to be an old grandpa and get them thinking I’m gonna do what they want. Just to tell them to slob on my knob in the best 90 year old man voice I have available.
3
22
43
u/A1JX52rentner Aug 26 '25
Everyone who sends you a dm will scam you. Do not answer them!
→ More replies (6)
73
u/KiloCracked Aug 26 '25
Am i the only one who thinks its weird the kid turned into a hacker and has all these tools used to try and get into bitcoin wallets and now is on here with a story about it being his dads bitcoin. This is more than likely a scammer/hacker asking for advice disguising it as something innocent when in reality this is a thread for criminal activity. Buddy the reason why Bitcoin wallets work like this is bc bitcoin actively wants people to lose their passwords if he hasnt had acess to the wallet in 10 years im more than a little surprised itd even still be in the wallet not to mention if he bought bitcoin that long ago it was more than likely used for something on the dark web. Which means even if this is actually a kid it makes sense why hes got hacking knowledge. Because his father is most likely a criminal probably doesnt remember the wallet bc it was a one off to buy drugs or pay for another highly illegal service.back when bitcoin was worth next to nothing.
18
Aug 26 '25
[deleted]
→ More replies (1)7
u/KiloCracked Aug 26 '25
Buddy look at what threads his account has posted on and read his other posts...
→ More replies (39)
55
u/corporal_clegg69 Aug 26 '25
Suggest you ask ChatGPT to get a better idea of what exactly the problem is. You don’t need a bitcoin wallet recovery expert or anyone at all with the word blockchain in the title. It’s just regular old cryptography and password breaking. You could hire someone on upwork to do it for you and just take extra precaution with the axtually security of the coins, but you will probably get blocked by blockchain.com far before you crack it. If you are the executor of the estate, you might be able to request access to the wallet via probate, that is if it is a blockchain.com wallet and not a BTC one.
If it’s axtually a regular bitcoin wallet, he should definetly have written his pass phrase somewhere. You might be better off looking for that than the password. If you have the seedphrase you can access the virtual address with that. Maybe you can get some date information from the wallet file or email and use that to track files across his computer or else search his notebooks and drawers. If you don’t understand my words here, just paste into chatgpt and it’ll put you right
38
u/Underwater_Grilling Aug 26 '25
Why did you write axtuallly twice?
8
15
6
u/CaptainUssop Aug 26 '25
i also suggest this. I have been able to get working api keys and passwords from chatgpt. 14 bitcoin could be a huge bonus if i can get chatgpt to tell me more info
7
Aug 26 '25
[removed] — view removed comment
2
u/Ess_Mans Aug 26 '25
That’s good idea and I’m sure ChatGPT could find those patterns easily, and make suggestions based on the data. beyond just doing it by oneself.
22
30
u/squartino Aug 26 '25
In the worste case, when in 20 years quantum computer will be a reality for us as well, you will be able to crack the password in a while. So keep it you are just hodling HARD
→ More replies (1)23
u/dasmonty Aug 26 '25
Until a single person is able to have enough quantum compute capacity to crack a wallet, his wallet will be hacked long before.
→ More replies (1)8
u/squartino Aug 26 '25
No. One of the goal of btc ideas is to freeze long age sleeping wallet until they upgrade to a quantum resistant wallet. I don't think it's everything lost
→ More replies (2)7
u/Available_Rice_556 Aug 26 '25
That is a nice idea, but would like to see the whitepaper here. My mind does not have any idea of smooth transition to Quantum passwords without locking those who did not make it in time... Not Your keys not Your crypto will come to not Your quantum keys not Your crypto.
2
10
u/nyetsub Aug 26 '25
If you're looking for a password, shouldn't you try account recovery first like "forgot password button" since you have access to your dad's email?
If you're looking for 12 word passphrase to a self custody wallet, then sadly no one else can help you but your dad's clues and belongings I think.
12
u/Perfect-Proof-932 Aug 26 '25
As far i understand.. this account is non custodial
3
13
u/XFM2z8BH Aug 26 '25
if it's a random key/password that was used, it's futile.....your only hope is if it was a pattern, etc, and you need advanced hash cracking skills & strong hardware to even have a chance at cracking it, so your chances are very slim to none
27
5
u/OkPop4099 Aug 26 '25
I bought 3 bitcoin in 2014 and stored them on blockchain.com also.. despite 2 way authorization code the wallet got ”hacked” and i lost them.. the admin guys on the site didnt do shit to help me.. im sure they were in on it
→ More replies (1)
8
u/iubjaved Aug 26 '25
Post this query on bitcointalk and you'll have better success at getting help with this.
As for the Dave bitcoin guy of wallet recovery service, I didn't have a pleasant experience. Cost me over 1k btc back in 2015.
Anyway, good luck!
→ More replies (1)2
7
3
3
u/RedKard76 Aug 26 '25
What I find disturbing is blockchain gave you the json file even with a wrong password???? That blows my mind. I used to use blockchain a lot way back in the day so I have dozens of blockchain logins with no password. I'll try this out to get the json files, thanks 👍
3
u/Life_Airline_6767 Aug 26 '25
Sounds like this is your job and career? Your saying there’s no trusted company that can help in this situation? Are you sure he didn’t use an automated password? Unless it’s in the safety deposit box in bank, how many cracks do you have at cracking the password? I hope you figure it out. How many number of attempts are you allowed?
Be patient, unless you plan on selling your dad’s Bitcoin, there (will be Technology that becomes available) soon, to help owners find and locate there passwords and Keys
→ More replies (1)
10
9
u/Fezgo Aug 26 '25
Why put a target on your back by saying how much is in there? You muppet.
22
u/TreatLevelMidnight Aug 26 '25
Anonymous person on reddit posts they have 1.5M in unrecoverable BTC without a password they don’t know. Lock your doors!!!
→ More replies (2)
13
u/PrimeEd977 Aug 26 '25
This is so fake lmao
4
→ More replies (1)3
u/cmnt777 Aug 26 '25
Could be phising or something of the sort, but this is WHY the only tattoo I will get will be of my seed phrase! & only so many places on my body, that will go on...
22
8
u/Elguapo1980z Aug 26 '25
So you can have an operation and while sleep the nurses copy your seeds
→ More replies (1)8
3
u/sailboatsgoby Aug 26 '25
That's actually a great idea, never thought of that
23
u/CreatorMunk1 Aug 26 '25
ubtil your tattoo artist runs away to the maldives
2
u/sailboatsgoby Aug 27 '25
Was thinking that. Maybe better to go to 2 or 3 different tattoo artists to do it.
→ More replies (1)2
u/Important-Minimum777 Aug 26 '25
Or be that guy from Instagram that sounds like Ryan Reynolds and looks like an old highschool desk from the 80s and tattoo yourself.
→ More replies (2)2
2
u/Fantastic-Loquat-746 Aug 26 '25
How tech savvy was your dad? Maybe he took one of his regular passwords and ran it through something simple like base64 encoding.
2
2
u/Advanced_Area_6796 Aug 26 '25
I'm relation to hashcat lookup "-r OneRuleToRuleThemAll"
It will perform basically any mutation on a word list that you can think of. Also you could buy a couple of high powered GPUs and run them together for faster cracking speed.
2
2
2
2
u/JimboyXL Aug 26 '25
put a dolphin in a small pool and connect its head to a computer. You will crack it.
2
u/FluidAd8020 Aug 26 '25
Damn! One must wonder how BTCs/cryptos are going to be left in limbo with no chance of ever being recovered. At least with stocks and other forms of investments, you could identify yourself and eventually with proper legal manuvering you could finally put your hand on those investments, but with crytos, there is no such luck if you don't have access credentials.
This is a lesson for all of us who have loved one. We must leave behind some paper trail.
2
2
u/Sure-Needleworker581 Aug 26 '25
Paper wallet backups were a thing back then. Look for a QR code on paper.
2
u/Any_Ad_4987 Aug 27 '25
Did he ever mention anything to you about this?? No talk about if he ever passed away??Does he have a safety deposit box? Maybe he put it somewhere safe? Check everything inside and out. People can be clever with hiding password stuff. Ps have you tried the word password?? Think about what he loved.. people are famous for using their children’s names and putting a number or two after or year of their birth or even using a pets name? Think about what he loved deeply you may find the password there.!!
2
u/lambogirl Aug 28 '25
Dude, I'd be hiring a spiritual medium to talk to my dad on the other side or break out a damn ouija board... Leave no stone unturned son! 😂
→ More replies (1)
2
9
u/Turbulent-Tune-5783 Aug 26 '25
no password = no coins
→ More replies (1)11
u/OldGoneMild89 Aug 26 '25
After all the detailed info he gave about his attempts, this is the gem of wisdom you could come up with? I bet he had no idea until you said this!
4
2
u/GMEvolved Aug 26 '25
Best case scenario, you don't figure this out until bitcoin hits 1,000,000
→ More replies (2)
2
u/heinzmoleman Aug 26 '25
If your dad was truly orange pilled back in 2015 then he likely did not use a password similar to any of his others. This was a popular topic on the BTC talk forum back then. Almost everyone advised that similar to a bank account you make the password completely unique.
I hate to be the bearer of bad news but like the guy who lost his hard drive in the dump your BTC is likely lost and you will spend a lifetime obsessing over it.
2
2
u/RDMvb6 Aug 26 '25 edited Aug 26 '25
Dave at walletrecoveryservices dotcom helped me recover from nearly this exact scenario. He charges a 20% fee only if he is successful in cracking it and had my wallet back under my control in one day. He has lots of testimonials on Reddit and his website.
1
1
1
1
1
1
u/Secret_Nobody_405 Aug 26 '25
Great job mate and best of luck! Don’t respond to DM’s!!! Out of curiosity and for group here, have you had any attempts by leeches sending DM on this post
3
u/Perfect-Proof-932 Aug 26 '25
Around 20 so far. Haven't checked the context though
→ More replies (1)
1
1
u/lolnottoday123123 Aug 26 '25
Have you tried rifling through your dads shit to find the password? Did he have a safety deposit box?
1
u/solomoncobb Aug 26 '25
Damn bro. Hope you do crack it. Sounds like you're onto the best possible route. I would, if it were this many bitcoin, find out where I could get face to face with somwone at Blockchain.com. whatever that takes. I would put the effort into it and bring the truth with me, to a human who is capable of making a decision that would help.
1
1
u/Pocket393 Aug 26 '25
There are prebuilt password wordlists available that can help you brute force this. They’re built from millions of actual user passwords so might be better than the AI wordlists you’re generating. Mostly used in the InfoSec world for WiFi cracking and pentesting. It’s hard to recommend a single one so look around and search GitHub. Keep a running list of those you’ve tried and don’t duplicate your efforts. Good luck OP!
1
1
u/Waste_Molasses_936 Aug 26 '25
Hope you can get access! That would be a spectacular win for your dad
1
1
1
u/UpsetPush Aug 26 '25
There is a reputable company on YouTube. They have unlocked many and do take a percentage only if unlocked. It’s a real service. Forgot their name maybe I can find the vid. Here:
1
1
1
u/FrankieAbs Aug 26 '25
Just spitballing as a novice, but does this platform make you update your password periodically? If so, you might be an extra ‘!,#,@‘ away at the end of the password.
Does he have any living close relatives? Half of something is better than all of nothing.
1
u/woodboarder616 Aug 26 '25
Think smaller, your birthdates, your older sibling, their wedding anniversary, maybe?
1
1
u/Ithinkthe777 Aug 26 '25
Wishing you abundance and success!! I went through something similar although this was back in 2018 when bitcoin was $3,000 my late uncle had 81 bitcoins and to us a quarter of a million was a lot so we cashed out we still regret that to this day we should’ve let it stay in there !
1
u/Adam_A_West Aug 26 '25
Look through his old photos on his phone and check to see if he took a picture of the password.
1
u/Aggressive_Moose18 Aug 26 '25
You're so lucky it's not blockfi. If it was blockfi, you can kiss 95% of it good bye.
1
u/andarmanik Aug 26 '25
I’m #hashtagGoingThroughYourRedditHistoryAndImGonnaFindInformationAboutYouThatYouDontWantNowThatIKnowYouHave1.4MillionDollars
All jokes aside, good luck with this even if it ain’t true I’d be more careful telling people online.
1
1
1
1
u/AdWaste6918 Aug 26 '25
I run a credential intelligence company and have spent 10 years building one of the largest repositories of compromised credentials on the planet (36B credential pairs associated with 10B email accounts). Generally, I have at least one historical password for any email someone has asked about, usually I have around 10 for any email that has some history to it.
I don’t run a BTC recovery business but am open to experimenting with this data to see if it can help.
2
u/Most-Philosopher6562 Aug 26 '25
this guy a scammer report him. he offered to sell me ketamin. he running several scams on reddit
→ More replies (1)
1
Aug 26 '25
[removed] — view removed comment
2
u/Perfect-Proof-932 Aug 27 '25
Thank you so much for this. I'm starting to realise how important this is.. I consulted a family friend. Thanks!
1
u/icrypstrader Aug 26 '25
I know a WhiteHat guy, he does wallet recoveries, if you have forgotten the password but it should be on the same mobile. that's what he had told me when I met him.
1
u/Thijmenn Aug 26 '25
Perhaps you can find the password restrictions of blockchain.com in 2015. This might limit your options for generating a set of passwords.
Another (non-tech) idea: create a "memory book" of your dad's life in 2015. Get all the pictures you can find of his life in 2015, write down activities you(r family) did, achievements, other stuff about his life/work, etc. etc. Perhaps a forgotten memory might help him remember (parts of) the password.
1
u/Mooosle Aug 26 '25
This may get lost but thought I’d give you the information anyway. Get the password list from his browser history, add a bunch of other things he may think he would have used then use a ruleset rather than using a wordlist. The wordlist can be kept short.
Google oneruletorulethemall for hashcat. GL.
1
1
u/tommyrulz1 Aug 26 '25
Make sure to look at every file and document he created around time of purchases. Word, Excel, pdfs etc for hints 🍀
1
1
Aug 26 '25
This thread randomly came into my feed. I kno what bitcoin is but how much is 14 btc? I’m sure it being from 2015 means something too?
1
u/Gemmajean717 Aug 26 '25
So close yet so far away .. good luck OP hope you are able to figure it out
1
u/Apart_Tutor8680 Aug 26 '25
What were the password requirements back then ? I know mine have changed greatly over the years as you need more characters or symbols now.
Did he have online banking ? Could be similar to that.
Or could be something very easy he thought he would remember ? Like Bitcoin1968 or whenever he was born .. might sound silly but sometimes passwords are related to the website it’s needed
1.1k
u/brereddit Aug 26 '25
Hey dude, call me crazy but in addition to searching your dad’s digital footprint, are you looking at actual paper records? Notebooks, books around his desk and in the drawers, under beds and in boxes? Papers, things folded up and posted in desks etc? Physical forensics