GREP help: Bitcoin address/key buried as text somewhere on hdd

Bitcoin Asked by StormShadow on December 17, 2020

So in a drunken moment of genius I had forgotten about, I bought some bitcoin way back. And I buried the address and key in some file… I was being tricky lol. That likely also led me to abandon a wallet.dat completely.

I’m learning to use grep to hunt it down, but the one time I know I got it to work, it returned TONS of files.

I know the address starts with 1F or.. f .. or D.. or d, maybe E/e lol. But one of those. The original parameters from stackoverflow for finding the address are:


I’ve attempted to adjust it to remove the 3 and have been attempting to add the first letter, but I’m trying a grep search with each and as I see no results after 20-30 minutes, I just ctrl-c the thing.

I’m trying

I removed the ^ and $ from the ends after when I realized that there is no reason to think it’s at the beginning or end of a line (if I properly understand what that even means).

The search area is for where I’ve recovered the files from these drives to, I’m hoping my “genius” drunken drive mapping attempts and subconscious file preservation impulse kept the file(s) from being overwritten.

Any help would be very appreciated, thank you.

One Answer



I removed the ^ and $ from the ends after when I realized that there is no reason to think it's at the beginning or end of a line ...

As you noted, the trailing dollar sign ($) anchors the search expression to an end-of-line (e.g. LF on Linux) - you probably do not want to do that.

However the [^13] does not anchor the search to start of line, inside square-brackets, the caret ^ means not. So [^13] means look for a string whose first 8-bit character is not a 1 nor a 3. It would match strings that begin with any other character - that is probably not what you want. If you want a string that begins with a 1 or a 3 just use [13]. If you wanted to anchor that to the start of a line you'd use ^[13] not [^13].

... (if I properly understand what that even means).

The expression ^[13][a-zA-Z0-9]{25,34} matches these lines:

1234567890123456789012345 is my secret code

where the 1 or 3 immediately follow a prior LF character (or are the first character in a file).

but does not match either of

my secret code is 1234567890123456789012345

Answered by RedGrittyBrick on December 17, 2020

Add your own answers!

Related Questions

What kinds of wallets are there?

3  Asked on December 23, 2020 by karlito


From Edge to Poloniex

1  Asked on December 22, 2020 by don-myers


What is the longest firstbits?

1  Asked on December 17, 2020 by lurf-jurv


Proof of address ownership

1  Asked on December 15, 2020 by theruss


Stale block verification at node level

2  Asked on December 10, 2020 by user87441


How to automatically get transaction while sending BTC?

0  Asked on December 2, 2020 by abhishek-pandey


Ask a Question

Get help from others!

© 2023 All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP