# find the correct regular expression to use

**URL:** <https://sleuthkit.discourse.group/t/find-the-correct-regular-expression-to-use/3769>\
**Category:** Autopsy Help\
**Created:** [May 10, 2023, 7:42pm UTC](https://sleuthkit.discourse.group/t/find-the-correct-regular-expression-to-use/3769 "2023-05-10T19:42:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![binarry01](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@binarry01](https://sleuthkit.discourse.group/u/binarry01)\
**Post date:** [May 10, 2023, 7:42pm UTC](https://sleuthkit.discourse.group/t/find-the-correct-regular-expression-to-use/3769/1 "2023-05-10T19:42:19Z")

</div>

i want to use a regular expression on autopsy to find all entries of (private bank or privates-banks, or _private_bank\*) i have used this syntax

(index.dat | _private_bank\*) so is it the correct syntax

thank you

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [May 10, 2023, 7:46pm UTC](https://sleuthkit.discourse.group/t/find-the-correct-regular-expression-to-use/3769/2 "2023-05-10T19:46:34Z")

</div>

That doesn’t look right, but I also think discord might be doing some formatting you didn’t intend. I suggest using something like [RegexPlanet: online regular expression testing for Java](https://www.regexplanet.com/advanced/java/index.html) to build your regex, then test using a logical file set: [Autopsy User Documentation: Data Sources](http://sleuthkit.org/autopsy/docs/user-docs/4.19.3//ds_page.html#ds_log)

Make a folder on your system, put in some files and rename them to be what you want to match, ingest that folder using the logical files option, and then try running your regex.

---

<div class="post-metadata">

**Author:** ![binarry01](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@binarry01](https://sleuthkit.discourse.group/u/binarry01)\
**Post date:** [May 11, 2023, 7:28am UTC](https://sleuthkit.discourse.group/t/find-the-correct-regular-expression-to-use/3769/3 "2023-05-11T07:28:39Z")

</div>

ok i have understood , thank you very much