wallet.dat is Bitcoin Core.

It depends on what data you have and how intact you think the data is. Is it a bunch of unnamed files and you're trying to figure out which may be a wallet? Or are you looking at raw data from the drive directly (e.g. in an image file)? Or something else?