GREP help: Bitcoin address/key buried as text somewhere on hdd

Question

So in a drunken moment of genius I had forgotten about, I bought some bitcoin way back. And I buried the address and key in some file… I was being tricky lol. That likely also led me to abandon a wallet.dat completely.

I'm learning to use grep to hunt it down, but the one time I know I got it to work, it returned TONS of files.

I know the address starts with 1F or.. f .. or D.. or d, maybe E/e lol.  But one of those.  The original parameters from stackoverflow for finding the address are:

[^13][a-km-zA-HJ-NP-Z1-9]{25,34}$.

I've attempted to adjust it to remove the 3 and have been attempting to add the first letter, but I'm trying a grep search with each and as I see no results after 20-30 minutes, I just ctrl-c the thing.

I'm trying

I removed the ^ and $ from the ends after when I realized that there is no reason to think it's at the beginning or end of a line (if I properly understand what that even means).

The search area is for where I've recovered the files from these drives to, I'm hoping my "genius" drunken drive mapping attempts and subconscious file preservation impulse kept the file(s) from being overwritten.

Any help would be very appreciated, thank you.

RedGrittyBrick · Answer

[^13][a-km-zA-HJ-NP-Z1-9]{25,34}$.

...

I removed the ^ and $ from the ends after when I realized that there is no reason to think it's at the beginning or end of a line ...

As you noted, the trailing dollar sign ($) anchors the search expression to an end-of-line (e.g. LF on Linux) - you probably do not want to do that.

However the [^13] does not anchor the search to start of line, inside square-brackets, the caret ^ means not. So [^13] means look for a string whose first 8-bit character is not a 1 nor a 3. It would match strings that begin with any other character - that is probably not what you want. If you want a string that begins with a 1 or a 3 just use [13]. If you wanted to anchor that to the start of a line you'd use ^[13] not [^13].

... (if I properly understand what that even means).

The expression ^[13][a-zA-Z0-9]{25,34} matches these lines:

1234567890123456789012345 is my secret code
3aklsdjlajkjvcnbxuxcjvhhkjhgtresds

where the 1 or 3 immediately follow a prior LF character (or are the first character in a file).

but does not match either of

my secret code is 1234567890123456789012345
    3aklsdjlajkjvcnbxuxcjvhhkjhgtresds

GREP help: Bitcoin address/key buried as text somewhere on hdd

One Answer

Add your own answers!

Ask a Question