Searching for Bitcoin

Welcome back :) As you may remember, Ross and I were pretty involved in Bitcoin. It had been awhile since I checked in on any of my BTC, so I decided to search some old hard drives and computers for my lost coins. As luck would have it, I found my old wallets and made out pretty well. That said, I wanted to leave some resources for those that would be looking for old, lost wallets. 

The first is a bitcoin yara rule, that one can use to search any raw files or disks for lost bitcoin wallet contents, just as you would normally use YARA.

If you happen to be on a Windows machine and want to search a set of directories recursively for a "wallet.dat" file, the following command can help you (make sure to run as Administrator): dir /s /b | findstr /i "wallet.dat" 

If you are on a Linux machine you can use the following command to search for a "wallet.dat" file (be sure to run as root): find -iname "wallet.dat"

Finally, I found the following presentation on finding wallets on disk and extracting them from memory. Enjoy and good luck hunting for digitial gold!