Last time I had this happen (thankfully a long time ago) I just used Perl against the block device and used a regex.

Forensic tools also work well for this.