DLT - Data Logic Tools - Recovery Suite

DLT - Data Logic Tools - Recovery Suite 3.2.0 (Windows) - recovery, photo/video repair, disk clone & secure wipe (free scan)

DLT - Data Logic Tools - Recovery Suite 3.2.0 (Windows 10/11 x64)
Recovery · photo/video repair · disk imaging · secure wipe - free scan and preview

Hi HDDGuru,

I am the developer of DLT - Data Logic Tools - Recovery Suite. This is a vendor post, so I will keep it factual: what the software does, how it does it, what it does not do, and how to evaluate it. The suite is commercial. Scanning and preview are free; saving recovered files, cloning, repair output and wiping require a licence. Feedback, bug reports and technical criticism are welcome in this thread.

One Windows application, eight tools

1. Drive Recovery

Intact-first pass: reads the NTFS Master File Table ($MFT) directly, decodes $DATA attributes and VCN->LCN data runs, and walks $INDEX_ROOT / $INDEX_ALLOC folders, so deleted files come back with original names and paths.
FAT32 and exFAT cluster-chain recovery, including fragmented files; exFAT is prioritised for modern SD/microSD cards.
Signature-based deep scan when metadata is gone: JPEG, MP4, RIFF, ZIP and hundreds of other headers/footers are carved from raw sectors.
Sources: logical drives, whole physical disks, and raw images (.img, .dd, .raw).
Recycle Bin recovery: deleted $R* user files are listed; only $I* index records and desktop.ini are hidden.
Scan area: restrict Deep Scan to a start/end offset in GB (or a preset), useful on large or failing drives.
Resilient scanning: slow or unreadable blocks are retried, then skipped in growing steps so the scan continues instead of appearing frozen. The finish message lists skipped byte ranges.
Honest status: a truncated image, unplugged drive or unreadable area is reported as "Scan incomplete" with the byte reached - not as success.
File-backed images are read end-to-end in Deep/Auto mode; filesystem extents are not skipped, so data past the first gigabyte is not missed.
Scanning is read-only; nothing is written to the source.

2. Partition Recovery

Searches for surviving metadata: NTFS boot-sector mirrors, FAT backup sectors, and the GPT backup header at the end of the disk.
Rebuilds a lost partition table from 0x55AA boot-sector signatures; quick scan for intact tables, deep scan sector by sector for damaged ones.
Partition tools included: Initialize Disk (MBR/GPT) and in-place MBR<->GPT conversion, with the existing table backed up first, explicit confirmation, and Administrator rights required.

3. Photo Repairing Lab

JPEG repair: DQT (quantisation) and DHT (Huffman) tables transplanted from a healthy reference image; SOI/EOI and restart markers re-synced.
"Beheaded" JPEGs: valid entropy-coded scan data re-spliced onto a rebuilt frame header.
RAW structure repair: TIFF/IFD chain validation and pointer repair for CR2/CR3, NEF, ARW, DNG, ORF, RW2, RAF, PEF, SRW, X3F and more.
When RAW image data is damaged, the embedded full-resolution JPEG preview is extracted directly from the RAW container. EXIF thumbnails are also recovered.
Every output is checked with a full decoder pass; "100% Healthy" is only reported when the repaired file decodes cleanly.

4. Video Repairing Lab

Containers: MP4, MOV, M4V, 3GP/3G2, AVI, MKV, MTS/M2TS, WMV, FLV, WEBM, MXF.
Repairs missing/broken moov, stco/co64 chunk offsets, truncated mdat, empty stsz/stsc sample tables, fragmented headers, AVI idx1 loss and MKV EBML damage.
Rebuilds the index from the media stream by NAL-unit scanning (H.264/AVC and H.265/HEVC), transplants SPS/PPS codec configuration, recomputes chunk offsets and re-syncs AAC/ADTS audio.
Handles action-camera and drone telemetry metadata interleaved inside mdat, so it is not mistaken for video frames.
AUTO REPAIR works on beheaded or containerless raw streams: codec sniffing, full frame + audio scan, clean MP4 rebuild.
Every repair ends in a full-decode verification gate.

5. Camera Card Rescue

Built around camera-specific erase behaviour: detects low-level formats and TRIM on Sony Alpha, Canon and Nikon cards, then switches to EXIF-based cluster carving.
Reads GPS, lens and timestamp metadata to rebuild photos that lost their headers.
Per-extension detection with counts and a plain verdict before committing: recoverable, quick format, or TRIM-erased.

6. Disk Clone

Sector-by-sector copy in four modes: disk->disk, disk->image, partition->partition, partition->image.
Bad-sector handling: configurable read retries, then skip and log, so the copy keeps reading where other tools stop.
Multi-pass salvage: pass 1 copies at full speed and zero-fills unreadable blocks; later passes retry only those ranges with progressively smaller reads, down to 512 bytes. Choose 1-6 passes (3 recommended; 1 = single pass). Pause/resume and cancel work during salvage, and a resumed clone continues at the pass where it stopped.
Pause & resume: every checkpoint is written twice (primary + backup); the backup is used automatically if the primary is unreadable. Auto-resume continues a matching clone on the next start after checking the target position.
Live settings while copying: block size, retries, salvage passes, ignore-bad-sectors, verify, auto-save interval, stall timeout and after-completion action. A saved-clone list lets you pause and switch jobs safely.
Source health panel: read errors, retries, slow reads, bad regions and S.M.A.R.T. warnings where the drive reports them.
Verify After Copy (Read-Back) is ON by default. Verification compares the target against a block-by-block SHA-256 fingerprint taken during the copy, so a source that is in use or disconnects cannot turn a perfect copy into a failure, while a damaged target is still caught and the first differing block is named.
A finished copy writes a plain-text <name>.dltmap sector map of readable and unreadable ranges.
A verified image clone writes a <name>.dltverify check file next to the image, holding every block fingerprint, so the image can be re-checked later on another PC without the source drive.

7. Image Explorer (Clone / Full Suite licence)

Opens .img, .raw, .dd, .vhd and .vhdx images; lists MBR and GPT partitions, including 4K-sector disks and backup-GPT recovery.
Handles images whose disk data starts after a small tool-specific header at any byte offset (for example, a 30-byte header written by some imaging tools).
Folder-tree browsing with filters, extraction of selected files or everything, and a Verify Image button that re-checks the image against its .dltverify file.
Honest container detection: proprietary compressed images, QCOW2, VMDK, VDI, WIM, ISO, DMG and archives are identified with conversion advice. BitLocker, Linux and macOS whole-disk images are identified but marked not browsable (no ext4/APFS/BitLocker parsers).

8. Wipe (Erase Sectors)

Overwrite patterns: zeros, ones, random, and DoD 5220.22-M 3-pass, written through raw device handles.
A verification pass confirms every sector after writing.
Multi-drive batch wiping with per-drive progress, speed and percentage.
Optional automatic Shut Down / Restart / Standby / Hibernate when the job completes.

What is new in 3.2.0

Scan area control for Deep Scan.
Resilient scan retries/skips and an explicit "Scan incomplete" status.
Multi-pass clone salvage with 1-6 passes and resume-at-pass.
Plain-text .dltmap sector map output (readable and unreadable ranges).
.dltverify check file is now written after a salvaged image clone as well, so Verify Image works for those images.
Image Explorer Files list now resizes Name/Size/Status to the pane, so Status is no longer clipped at the default window size.
A finished image clone can open directly in Image Explorer, even while the live Cloning monitor is open.

Honest limitations

Windows 10/11 64-bit only; Administrator rights are required for raw disk access; activation needs an internet connection.
Metadata-aware recovery covers NTFS, FAT32 and exFAT. Deep signature carving is filesystem-independent, but original names/paths are not available once metadata is gone.
No software can recover data that the drive or controller has already overwritten or TRIM-erased. The app reports that condition instead of pretending otherwise.
A physically failing drive should be imaged first; drives that click, spin down or are not detected need hardware-level work, not software.
Recovery success depends on the device, the damage and what was written after deletion. Test on a copy and never write recovered output to the source drive.
A resumed clone may not have a .dltverify file, because earlier blocks were copied in a previous session without fingerprints.

Requirements, trial and licensing

Windows 10 or 11, 64-bit; Administrator rights; internet for activation.
Free: scan and preview on any connected drive, card or image.
Licence required for: saving recovered files, clone, photo/video repair output, and wipe.
Tiers: Professional (1 PC), Technician (5 PCs), Corporate (10 PCs). Terms: 30 days, 90 days, 1 year or Lifetime. Licences activate online and can be moved between computers.
Official download only: https://datalogictools.com
Version: 3.2.0
Installer SHA-256: fad00f775b0ef07d0d0efc0928d0a0eacaf5e41d6580e025762921a10c3b90cb

The installer contains no third-party bundles. As a new publisher, your browser or Windows SmartScreen may show a reputation warning ("not commonly downloaded"); that is not a malware detection. Verify the SHA-256 above and use "Keep" / "More info -> Run anyway". Only official builds are supported.

If you are working on a failing drive

Image the drive before scanning it, then recover from the image.
Save recovered files to a different physical drive, never to the source.
Stop and reassess if the drive makes unusual noises or keeps dropping offline.

I will answer technical questions in this thread. When reporting a problem, please include the DLT version, Windows build, exact drive/card model, connection type (SATA/USB/NVMe), the mode used, and the exact message shown. If the moderators prefer this thread in another section, please move it.