wallet.dat is Bitcoin Core.
It depends on what data you have and how intact you think the data is. Is it a bunch of unnamed files and you're trying to figure out which may be a wallet? Or are you looking at raw data from the drive directly (e.g. in an image file)? Or something else?
I am using winhex. I have the drives and made images out of them. I had the file on a flash drive and probably in several time machine backups. I since deleted the backups. I figure scanning the drive images for those magic numbers I have been reading about might help me find those private keys.