Free Download

Sherlock Forensics Recover

Most recovery tools guess. Sherlock Forensics Recover measures, then tells you which it did.

Every competitor says powerful and advanced and shows you a percentage. Sherlock Forensics Recover says this file has been overwritten and shows its working. It reads the true length of what it finds, proves a RAID layout against the data before it trusts it and writes nothing to the drive you are rescuing.

See Free and Pro

Version 0.1.366 | 3.0 MB installer | Windows 10/11 (64-bit) | EV-signed | SHA256 verified

Why it is different

It Measures Instead of Guessing

Your recovered photos open

Most tools do not know where a carved file ends, so they save the largest possible size: a 20 KB photo written out as 500 MB of surrounding disk. The length is wrong, so nothing opens it. Sherlock Forensics Recover reads the true length from the file itself. On one test drive a photo other methods reported as 524 MB was measured at 24 KB.

It tells you when your data is gone

On most modern SSDs, deleting a file makes the drive erase it within seconds. No software can bring that back. Sherlock Forensics Recover says so before you spend hours scanning, rather than selling you a scan it already knows will come back empty.

RAID that measures instead of guessing

Consumer tools ignore RAID. Professional tools ask you to pick the level, stripe size, disk order and parity rotation from dropdowns. A wrong guess produces an array that looks perfect for the first few files and is garbage after them. Sherlock Forensics Recover reads the array's own metadata first. When that is gone it searches the settings and scores each candidate against the file system structures that must appear at computed offsets. It refuses to assemble an array from an out-of-sync disk rather than producing one that mounts and is wrong.

Nothing is written to the drive you are rescuing

Not a temporary file, not a log, not an index. And it will not let you save recovered files back onto the drive you are rescuing, which is the single most common way people destroy the files they were trying to save.

Free and Pro

Free vs Pro

Free covers browsing a volume, previewing files, exporting them and creating a disk image in raw or E01 format. It is a complete FTK Imager equivalent, not a trial and not a limited build. Pro adds deleted-file recovery, carving unallocated space, RAID reconstruction, lost-partition search and the previous versions Windows kept.

CapabilityFreePro
Browse a volume and preview filesYesYes
Export filesYesYes
Create a disk image (raw or E01)YesYes
Deleted-file recoveryNoYes
Carve unallocated spaceNoYes
RAID reconstructionNoYes
Lost-partition searchNoYes
Previous versions Windows keptNoYes

Free

$0
No trial, no limited build. A complete imager.
  • Browse, preview and export
  • Raw and E01 disk imaging
  • EV-signed, Windows 10 and 11

Pro

$295
One-time payment. No subscription.
  • Deleted-file recovery
  • Carving unallocated space
  • RAID reconstruction
  • Lost-partition search
  • Previous versions Windows kept
Get Pro - $295

What it refuses to claim

The Receipts

The difference is what it refuses to claim. Sherlock Forensics Recover ships behind 15 build gates. Its readers are cross-checked against independent implementations that share no code with ours. It is measured against real media rather than fixtures. It carves 71 file formats, each validated against that format's own structure, which is why the number is lower than the 300 to 400 that competitors advertise and why the results carry far fewer invented files. Of those formats, 55 have their true length measured and 28 are proven to come back byte-for-byte identical to the original. 538 detection rules ship with it.

Download

Get Sherlock Forensics Recover

Sherlock Forensics Recover 0.1.366. Windows 10 or 11, 64-bit. The installer is 3.0 MB. The installer and the application inside it are both EV-signed by Sherlock Forensics Ltd and RFC3161 timestamped. The certificate is issued against a verified legal entity, with the signing key held on a hardware token that cannot leave it. No administrator rights are needed to install or to browse. Reading a physical drive directly does need elevation, which the tool requests with a relaunch rather than demanding at startup. Current Windows 10 and 11 include the WebView2 runtime the interface needs. A sealed forensic bench with no network and no WebView2 will stop the install, which is worth knowing before you take it somewhere air-gapped.

File
sherlock-recover-setup.exe
SHA256
dc188db50e62594c4b0e7503859d83e1c06475805b3f55a9aeaedee82d0f3f49
Version
0.1.366
Size
3.0 MB
Platform
Windows 10/11 (64-bit)

Get Started

Recover Files That Actually Open

Free data recovery software for examiners, IT teams and anyone facing a lost drive or a broken array. Built by the same team that delivers expert witness testimony in Canadian courts.

Since 2006CISSP, ISSAP, ISSMP certified888.883.4550

Sherlock Forensics Recover is provided for lawful use. Terms of Service

Download

Your email is optional. If you provide it, we send 3 product introduction emails over the next 2 weeks. No long-term marketing. No data sharing. Skip the field and download directly.