USAGE

SECTORSCAN -drive "{drive}" -search "{string}"
e.g.
remember to escape the drive with \\
sectorscan -drive "c:\\" -search "important data"

About BITCOIN detection
Bitcoin addresses come in a few different formats, but two of the most common are.

P2PKH (Pay to Public Key Hash): These addresses start with a 1 and are the original Bitcoin addresses. For example: 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2.

P2SH (Pay to Script Hash): These addresses start with a 3 and are used for multi-signature wallets. For example: 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy.

However, there are also newer Bech32 format addresses (starting with bc1), used for SegWit transactions.

Given the variability and potential for more address types in the future, it's tricky to create a regex that will capture all Bitcoin addresses accurately and future-proof, so I have made it so you can pass any regex expression and group many different ones.

These two may help you get started

if you're trying to detect P2PKH and P2SH addresses, you can use the following search string:

^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$

For Bech32 (SegWit) format, the regex can be complex due to the nature of the Bech32 encoding, but a basic version to detect addresses that start with bc1 and have the typical length might look like:

 
^bc1([a-zA-HJ-NP-Z0-9]{39,59})$CONTENT$nbsp;

just add them as normal

sectorscan -drive "c:\\" -search "^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$"

Recovered some bitcoin? send some love, paypal dave@daveduke.co.uk ;)