# Regex to find PIN

**URL:** <https://sleuthkit.discourse.group/t/regex-to-find-pin/2075>\
**Category:** Autopsy Help\
**Created:** [August 11, 2020, 10:57am UTC](https://sleuthkit.discourse.group/t/regex-to-find-pin/2075 "2020-08-11T10:57:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![solo](https://avatars.discourse-cdn.com/v4/letter/s/7bcc69/32.png) [@solo](https://sleuthkit.discourse.group/u/solo)\
**Post date:** [August 11, 2020, 10:57am UTC](https://sleuthkit.discourse.group/t/regex-to-find-pin/2075/1 "2020-08-11T10:57:33Z")

</div>

Hello,

I am trying to create a regex to find a pin code with this pattern:

pin=1234  
or  
pin:1234  
or  
pin 1234  
or  
“pin”=1234  
or  
“pin”:1234  
or  
“pin” 1234

I know that I can find 1234 with [0-9]{4}.  
But how can i find the first part of my expression?

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [August 11, 2020, 11:00am UTC](https://sleuthkit.discourse.group/t/regex-to-find-pin/2075/2 "2020-08-11T11:00:26Z")

</div>

Here’s one option:  
(pin|["“]pin["”])[=:][0-9]{4}