Windows logical data recovery

Understand what remains before you recover it.

Datattoo Recovery examines surviving filesystem metadata and file data on supported Windows storage sources. It separates recovery condition, filename evidence, overwrite indicators, and post-recovery validation so uncertain results are not presented as guaranteed recoveries.

Datattoo Recovery scan results showing recoverability conditions and file evidence in a controlled test session

Safety first: Stop writing to the affected drive. Recover only to a different destination. SSD TRIM and continued use can make deleted data unrecoverable.

Evidence and outcomes kept separate

Before recovery

Estimated recoverability based on surviving evidence:

Excellent Good Partial Overwritten Unsupported

Also includes Unknown and Possibly erased by SSD/TRIM when evidence indicates those conditions. A promising estimate is not a guarantee of a valid recovered document.

After recovery

Actual outcome after bytes are written and validated:

Complete Partial Unverified Failed

“Complete” is assigned only after recovery and validation—not as a pre-recovery selection category.

Current scope

  • NTFS, FAT12/16/32, and exFAT
  • Raw disk images with optional partition offset
  • ReFS is unsupported
  • Locked BitLocker volumes are not decrypted

Government & Enterprise

Datattoo is positioned for agencies, regulated organizations, and professional recovery operations that need controlled Windows recovery with evidence integrity and validation outcomes.

Three disciplined steps

  1. Protect the source and choose a supported drive, partition, or raw image.
  2. Review evidence—name provenance, path confidence, warnings, and recoverability condition—before selecting candidates.
  3. Recover to a different destination and read the post-recovery validation outcome.