Supported sources and partition discovery
Choose supported Windows storage sources and discovered partitions, including raw disk image files with an optional partition offset.
Features
Inspectable logical recovery for Windows—scoped to verified capabilities, not fear-based marketing.
Product capabilities
Explicit metadata and carving modes
Quick Metadata and Deep Carving are distinct modes. Quick does not silently escalate. Carving may use fallback names when metadata is missing.
Filters and search
Narrow large result sets by type, path fragments, size, and recoverability condition.
Preview and warnings
Preview and warning data help explain evidence quality before you select recovery candidates. UI labels follow the approved release build.
Video integrity and repair
Damaged video assessment and static repair are included with the paid Technician license—no separate add-on SKU. Original and repaired outputs can be retained for comparison.
Fully portable
Datattoo is fully portable. Copy the signed executable to a thumb drive or memory card and run it from removable media—no separate Visual C++ Redistributable, and no install required for field or air-gapped use.
Session persistence and local logging
Long jobs can be paused or cancelled safely. Installed builds log under %APPDATA%\DatattooRecovery\Logs; portable runs keep mutable data beside the executable under Data\.
Recover elsewhere
Recovery writes to a different destination volume with free-space and source/destination protection checks.
Filesystem engines
Datattoo includes recovery engines for NTFS, FAT12/16/32, and exFAT. Current automated evidence covers controlled fixtures; behavior on real media depends on surviving metadata, allocation state, fragmentation, overwrite, sector geometry, and device condition.
Static Visual C++ runtime
Release builds use the statically linked Visual C++ runtime and do not require a separate Visual C++ Redistributable installation—supporting fully portable deployment.
Evidence kept separate from outcomes
Pre-recovery recoverability conditions are not merged with post-recovery Complete / Partial / Unverified / Failed outcomes.
Important limitations
- Signature carving does not reconstruct original filenames.
- FAT first-character loss and incomplete NTFS parent paths can reduce name/path confidence.
- ReFS recovery is unsupported.
- Locked BitLocker volumes are not decrypted; EFS recovery depends on available certificates.
- SSD TRIM, overwrite, ambiguous matches, and physical damage can make logical recovery impossible.