How do I search for a hidden and disguised (extension changed) wallet file on damaged hard drive? Back in 2012 we had a bitcoin or two on a computer that crashed. It was a dual boot system and the wallet was in the Linux partitions. The user, a family member, changed the file extension to a extension document, probably open office or abiword. I am trying to reconstruct the hard drive, and have recovered the files from the Linux partitions. I need to know how to search for and find the file now. I have been researching my butt off trying to find a reliable way to find it. The only computer I have right now is an old XP laptop with 512 megs of RAM, won’t have a newer computer for another 10-15 days (got an excellent dell direct deal but shipping and delivery is absurdly slow). I have done plenty of desktop support and home computer repair for a living, but have been retired since 2014 and my Data recovery experience is limited. 

What I need most right now is a method to identify which among the hundred plus gigs of files is the wallet. First question is what is the minimum size of a wallet.dat file, so I can limit the time searches take by ignoring the zillions of files too small to be a wallet. I have seen one suggestion that new wallet files are about 96k. 

Second question is how do I search for it? I need a search term, a unique string of text or characters that is present inside of every bitcoin wallet. And will Windows file manager find the text inside of the wallet, or will I need yet another tool? I have been using a string of numbers (62 31 05 00) that was suggested on a post here but have no idea how effective that might be. 

Please note I have no Linux system or live cd for using Linux, and zero experience with Linux   I don’t think this is the time for me to master the Linux command line, the potential for screwing up and destroying data is too high.  I have imaged the Linux partitions from the old drive onto a 2 terabyte usb drive, and have recovered the files to that drive. Took me over a week. So the files are on a NTFS usb drive and should be safe to explore using Windows tools. 

Any help will be greatly appreciated.
Try searching words fromaccount or timesmart. Wallet.dat is binary, so there should'nt be too many words accessible, but these should.