Back in 2012 we had a bitcoin or two on a computer that crashed. It was a dual boot system and the wallet was in the Linux partitions. The user, a family member, changed the file extension to a extension document, probably open office or abiword. I am trying to reconstruct the hard drive, and have recovered the files from the Linux partitions. I need to know how to search for and find the file now. I have been researching my butt off trying to find a reliable way to find it. The only computer I have right now is an old XP laptop with 512 megs of RAM, won’t have a newer computer for another 10-15 days (got an excellent dell direct deal but shipping and delivery is absurdly slow). I have done plenty of desktop support and home computer repair for a living, but have been retired since 2014 and my Data recovery experience is limited.
What I need most right now is a method to identify which among the hundred plus gigs of files is the wallet. First question is what is the minimum size of a wallet.dat file, so I can limit the time searches take by ignoring the zillions of files too small to be a wallet. I have seen one suggestion that new wallet files are about 96k.
Second question is how do I search for it? I need a search term, a unique string of text or characters that is present inside of every bitcoin wallet. And will Windows file manager find the text inside of the wallet, or will I need yet another tool? I have been using a string of numbers (62 31 05 00) that was suggested on a post here but have no idea how effective that might be.
Please note I have no Linux system or live cd for using Linux, and zero experience with Linux I don’t think this is the time for me to master the Linux command line, the potential for screwing up and destroying data is too high. I have imaged the Linux partitions from the old drive onto a 2 terabyte usb drive, and have recovered the files to that drive. Took me over a week. So the files are on a NTFS usb drive and should be safe to explore using Windows tools.
Any help will be greatly appreciated.