I Scanned the Entire Bitcoin Blockchain for Images. What I Found Will Shock You

Bitcoin Magazine

I Scanned the Entire Bitcoin Blockchain for Images. What I Found Will Shock You

I scanned the Bitcoin blockchain for images; what I found will shock you. Much has been said online about the arbitrary data and content that can be found on the Bitcoin blockchain. Not only has this possibility spawned a niche art scene, but it has also led to a movement against ‘non-monetary transactions’ on the Bitcoin network. Were you to hear from one of its proponents or detractors, you’d figure the blockchain is basically a wall filled with graffiti. 

Well, I decided to put the question to the test: are there actually images on the blockchain? And what does this actually mean for Bitcoiners simply trying to run their own full node and maximize their financial sovereignty?

My methodology was simple: I was to buy a fresh hard drive to store the blockchain on, and then I was going to run classic image recovery software over the data- something used to rescue images from broken hard drives, something designed to find raw image data. 

I chose PhotoRec to do the image recovery work, an open source image recovery program that’s been around for over 20 years. The software is designed to find image files in raw data. This can be used to recover images and other file formats from hard drives that have failed or been corrupted. It is actually often used to recover lost wallet.dat files from the early days of Bitcoin wallets, before the proliferation of the seed word format. 

For storage of the full Bitcoin blockchain, I decided to buy a 4-terabyte disk drive for a couple hundred dollars. I then installed the latest version of Bitcoin Core on it and started to sync the chain. The process, which involves downloading and verifying the accounting integrity of all transactions in Bitcoin history, took about 72 hours or three days, automated and running in the background by the Bitcoin Core software.

I did this with an otherwise powerful gaming machine; the main bottleneck in terms of time was the disk drive, which is slow to read and write data as needed when syncing Bitcoin’s blockchain. The slow part of the process involves the unspent transaction output set, or UTXO. When a user syncs the blockchain, every unspent transaction value (output) or positive balance is organized into the UTXO set, and as those values are spent, they are removed from the set, while the new address to which those satoshi were sent is added. 

On the disk drive, this UTXO indexing process could have taken three weeks according to some estimates, so to speed it up, my clanker (AI agent) suggested we index the data in RAM instead, then move the data back to the 4-terabyte disk drive. While the whole process took three days, running in the background, an SSD could have done the whole job in about a day. SSD drives are much faster than disk drives; they are more modern, but they are also easily four times the price, or more.

Once the blockchain was fully downloaded and validated, we moved the UTXO index from RAM back to the disk and booted the Bitcoin software; the chain was fully synced and the wallet ready to go. Now it was time for the next step: recovering the images stored on the blockchain.

With the full Bitcoin blockchain on my disk drive, I turned off Bitcoin Core and asked my clanker (Cursor AI agent) to run PhotoRec 7.2 on the drive. The default PhotoRec process looks for jpg, png, gif, tif, bmp, ico, psd, and raw formats. The process ran for over 11 hours on the blockchain data and ultimately found … (drum roll) … nothing.

Over a terabyte of blockchain data and half a day of scanning and no images turned up. The PhotoRec wiki page gives a simple example of how the software works: “PhotoRec identifies a JPEG file when a block begins with: 0xff, 0xd8, 0xff, 0xe0, 0xff, 0xd8, 0xff, 0xe1, or 0xff, 0xd8, 0xff, 0xfe.” In other words, the program looks at the data on the disk for bytes that signal that there’s an image file. 

The program is capable of false positives; it saved 8 ICOs and 4 identical PNG files that don’t show any images when opened, as seen in the picture below. So, effectively no meaningful images of any kind were found. 

How is this possible? For years, crypto people have been talking about NFTs and how to engrave image data on the Bitcoin blockchain. Millions of dollars have moved in this niche, and a whole culture war is being fought on the matter as we speak. Can there really be no images on the chain? 

Turns out the risks involved with arbitrary data have been discussed and planned for in Bitcoin Core development circles for a long time, as early as 2011. XOR, a simple data obfuscation technique, is used to scramble all the blockchain data while it is at rest on a hard drive. 

You might have heard that the fundamental language of computers is made up of 0’s and 1’s. Well, in a nutshell, XOR compares two digits or bits and returns 1 if the bits are different or 0 if the bits are the same. In the case of Bitcoin, XOR compares every bit of the blockchain data to a random key generated during initial install, resulting in data at rest that other programs can find no meaning in. However, when the Bitcoin software runs, it has the key to unscramble that data and use it at will. XOR is also very fast, so it does not meaningfully impact performance. Here’s an example of the Bitcoin genesis block before and after an XOR.

XOR is currently applied to both the blockchain data and the UTXO set. XOR was initially discussed in 2014 when anti-virus software started getting tripped up by blockchain data it interpreted as virus code. The anti-virus software would then quarantine a block, corrupting the blockchain data and crashing Bitcoin, making sync impossible. By the end of 2015, XOR had been implemented on the UTXO set data at rest and in 2024 it was implemented on all blockchain data at rest. 

Incidentally, the XOR process means that no arbitrary data can be identified or extracted from the blockchain without intentionally bypassing the XOR, a process that is not necessary for monetary use of Bitcoin. Since the Bitcoin Core software keeps a simple database of the location of each scrambled block, it can get its data, unscramble it and use it in a targeted manner easily.

Syncing Bitcoin in an unscrambled way is a custom process that can take as much time as syncing from scratch, since it basically has to re-write the full terabyte of data in a new order, and there’s not much point in that for someone that just wants the normal privacy and security benefits of running a Bitcoin node. So when it comes to the vast majority of copies of the Bitcoin blockchain data, resting on the computers of normal Bitcoiners throughout the world, there’s effectively no arbitrary data or images that can be identified. Shocking, I know. Feel free to run the PhotoRec test yourself on your own node!

This post I Scanned the Entire Bitcoin Blockchain for Images. What I Found Will Shock You first appeared on Bitcoin Magazine and is written by Juan Galt.