Byte-exact where it can be checked, flagged where it cannot
A recovered file whose format the engine can check is identical to the original or it is flagged with the reason. A deleted file whose space was reused is flagged instead of handed back under the right name with the wrong bytes, a video or archive that will not open is graded as such, and a format with no signature in the database is returned marked unverified rather than judged.
Basis. Measured at 100 percent recall and precision, byte-exact, on our own test corpora: a 20-file base set, a 23-file stress set and 6 real media files. Those are small synthetic and specimen sets, not a guarantee for every drive. A content, media and archive check is applied to every recovered file whose format it can judge. In our source-checked comparison, neither recovery leader's page describes a content check.
Two families from one engine, one executable
Eight products are built from one tested core. The recovery products ship as a single standard-library Windows executable with no runtime and no packages to install, so a bench with no internet and no administrator on call still runs them.
Basis. One catalogue defines every product, and each build is verified in a clean environment to contain only its own workspaces. The recovery products carry no third-party runtime at all — a single Windows executable.
The Imager is free for everyone
Checking a drive with a feasibility verdict, imaging it to raw or E01, browsing its index and taking the files you tick, and ingesting a dump a chip-off or JTAG rig produced: no key, no gate, no use spent, ever.
Basis. The Imager needs no key and spends no use, and drive imaging, index browsing, file-level extraction and chip-off/JTAG dump ingest all ship in it. Neither R-Studio nor UFS Explorer publishes a free imaging edition with extraction.
Breadth of sources in one product
22 file systems by name, RAID 0/1/3/4/5/6/1E and nested 10/50/60 with automatic parameters, RAID-Z and Synology SHR, five virtual-disk formats, E01, Ex01 and AFF4 containers, recorder disks camera by camera, drone logs, phones, mailboxes, database rows and chip-off dumps, in the same application.
Basis. Every file system, RAID level, virtual-disk and evidence-container format listed here is implemented and tested in the product, and the coverage tables on this page are generated from that same engine — not a claim written by hand.
Court-defensible by construction
A hash-chained audit trail that names the first altered line, read-only measured before and after a job, the examiner's reading sealed before any model answers, the frame pack as the only unit that leaves the machine, and a draft certificate under Section 63(4) of the Bharatiya Sakshya Adhiniyam 2023.
Basis. The hash-chained audit trail, the read-only measurement taken before and after a job and the examiner's reading sealed before any model answers are all in the product and tested. In our comparison, none of EnCase, FTK, AXIOM or X-Ways documents a sealed prior reading or an S.63(4) certificate.
Offline, machine-bound licensing, sold by the drive
A key is signed offline for one machine code and one product. A use is one drive or image, however many files come off it, and the same source is free for ever after. No account, no activation server, no update check.
Basis. Licensing is offline and bound to one machine code. Our tests prove that no product opens a connection back to us, and that a key opens only the one product it was sold for.
Outbound connections blocked by default
Every product refuses public-internet connections at the socket layer, from bundled libraries as well as our own code. Loopback and the local network are allowed. The exceptions are named and operator-controlled: a model provider only after the operator turns it on, and cloud collection from the organisation's own tenant under a stated authority; specific public destinations can be allow-listed, off by default.
Basis. Outbound public-internet connections are refused at the socket layer, from bundled libraries as well as our own code, with loopback and the local network still allowed. The policy is covered by our own adversarial test round and a regression test; no third-party audit report exists yet.
The limits are stated, in the product and here
A drive that will not read says which link in the chain is broken. A locked phone with no public vector says which method would reach it. This site carries a section on where the category leaders are ahead of us, in the same type size as the rest.
Basis. A drive that will not read names the broken link in the chain; a locked phone with no public route names the method that would reach it. Our comparison reproduces where the category leaders are ahead of us, and /llms.txt lists what the products will not do.
