IBCSC Institut belge de
cybersécurité citoyenne
EN
Support

Diagnostics and data recovery 10 min read

Easy Disk Checker: diagnosing drives, SSDs and USB sticks

Reading S.M.A.R.T. data, scanning the surface, spotting a USB stick with a faked capacity, creating an image and recovering a lost partition table, all from a single portable executable.

A drive that slows down, a USB stick bought online whose stated capacity looks too good, a memory card that no longer mounts: in all three cases the first question is the same. Is the device failing at the hardware level, or only at the logical level? Easy Disk Checker answers that question without installing anything: a single portable executable that works at sector level rather than at file-system level.

The utility is free, runs on Windows 10 64-bit and later, creates no registry key and installs no driver. Every required library is embedded in the EXE file. It does, however, need administrator privileges: direct hardware access depends on them. The version used for this article is 5.7.2.

Read this before you start

Several functions described here write to the device: resetting the partition table, full write, writing an image, cloning. They destroy data irreversibly. On a device that still holds something useful, always start by creating an image, then work on the copy.

Installing and launching the utility

There are two official sources: the vendor’s site and the Microsoft Store. The Store version updates like any other Windows application; the ZIP archive extracts wherever you want, including onto a rescue stick. On start-up, the program checks for an update and offers to download it if there is one.

The interface exists in French, in English and in other languages; by default it follows the Windows regional settings and can be changed on the fly from the language button in the top right. The light or dark theme is chosen the same way.

The main window of Easy Disk Checker, in French, with the list of detected drives
The main window lists the detected drives and, below, the logical structure of the selected drive.

The first button queries the physical drives and at the same time rescans the controllers. That is what makes a hot-plugged device appear without restarting the application. For each entry, the list shows the model, the serial number, the firmware version, the size in gigabytes, the number of LBA sectors, the volume letter and the file system recognised by Windows.

When a drive is selected, its logical structure appears in the lower panel. If sector zero cannot be read, an information window says so immediately: that is often the first serious sign of a hardware problem.

Diagnosing a drive, an SSD or a stick

The Check the disk button opens the quick check. Whatever the device, it retrieves the identity data, the logical and physical sector size, the accessible volume, then verifies that reading works at the beginning, in the middle and at the end of the device.

The quick check window of a hard drive with the S.M.A.R.T. table, in French
The quick check brings together the drive identity, its state, its ATA protections and the full S.M.A.R.T. table.

Depending on the type of hardware, the report goes further:

  • Internal hard drives: rotation speed, full reading of the S.M.A.R.T. parameters with separate display of bad blocks and temperature, detection of an ATA password and of an HPA area that would hide part of the volume.
  • Seagate hard drives: reading of the FARM logs, more detailed than classic S.M.A.R.T.
  • External USB hard drives: identification of the real internal model and detection of TRIM support and of SMR technology.
  • SATA SSDs: the same information as for a hard drive, except the rotation speed.
  • NVMe SSDs: in addition, the state of Opal encryption.

Two extended tests are offered from this window. The first is a read benchmark; the second, a full read of the surface.

A read speed test showing the instantaneous speed and the average speed
The benchmark measures the beginning, the middle and the end of the drive: on a mechanical drive, the gap between zones is normal.
A surface scan showing a grid of blocks coloured by access time
The surface scan colours each block by access time: light green is under 50 ms, red is over 1.5 s.

The surface scan is the most telling measurement. Each block read takes a colour according to its access time: under 50 ms, under 500 ms, under 1.5 s, over 1.5 s, or in error. A healthy drive produces a uniform grid. Isolated orange blocks point to sectors that need several read attempts; red or blue blocks grouped in the same place betray a damaged area. On an 8 TB drive, count on several hours.

The special case of USB sticks and memory cards

For a removable device, the utility reads the VID/PID pair, compares it with its internal database of microcontrollers, then queries the memory with a proprietary command to obtain the NAND ID. The result: the controller manufacturer and the memory manufacturer are both displayed, whereas neither appears in Windows Explorer.

Detailed information about a USB stick: VID, PID, controller and NAND ID
For a USB stick, the utility shows the VID/PID pair, the recognised controller, the NAND ID and offers the counterfeit test.

The counterfeit test deserves a mention of its own. Many sticks sold online announce a capacity far above the memory actually installed: the firmware lies to the system, the first files copied look fine, and the following ones silently overwrite the earlier ones. The test writes and reads back patterns across the whole declared capacity and compares them; the discrepancy shows up immediately. A 512 GB stick bought for a few euros rarely has more than 16 real GB.

S.M.A.R.T. is not available everywhere

Most USB sticks and memory cards publish no S.M.A.R.T. attribute at all. Likewise, some USB-SATA bridges do not pass ATA commands through: an external drive can then appear without its attributes. For a complete diagnosis, connect it directly to a SATA port.

Repairing what can be repaired

Two functions deal with defects that software can fix. Neither revives a mechanically dead drive.

The partition table reset is called from the drive context menu, by right-clicking in the main window. It forces the table to zero; on a hardware-healthy device, that solves purely logical problems, including those that prevent Windows from reformatting the device.

The full write is available after the quick check. It writes block by block over the whole surface, which triggers the internal mechanism that replaces bad sectors when the device firmware provides for it. That operation is also a secure erase: all the data disappears for good.

Creating an image, writing, cloning

The Disk image button brings the four backup operations together.

The Disk image window offering to create, write, clone or open an image
The four imaging operations are gathered in a single window, with an explicit warning about writing.
  • Create an image: sector-by-sector reading of a drive or a volume into a .bin file, where the first sector of the file matches the first sector of the source. The .vhd and .vhdx formats are also available, with dynamic compression and native mounting in Windows. On a read error, you choose whether to stop or to continue, filling the unreadable sectors with zeros.
  • Write an image: restoring a .bin, .vhd or .vhdx file onto a drive. The size is checked before writing; a warning appears if the target is smaller than the image.
  • Clone the drive: direct sector-to-sector, block-to-block copy from one device to another.
  • Open an image: exploring the content of an image file and extracting files without mounting it in the system.

That sector-by-sector copy is particularly useful before any recovery attempt: it freezes the state of the device while it still works, including to clone the boot stick of a customised installation.

Recovering partitions and reading data

When the partition table has disappeared, the scan sweeps the device looking for MBR or GPT records and presents the partitions it finds. You tick the ones to restore, then you choose the table format: MBR for sticks and drives under 2 TB, GPT for SSDs, larger volumes and UEFI machines.

Searching for lost partitions and choosing between an MBR and a GPT table
After the scan, the recovered partitions are ticked one by one, then the table is rewritten as MBR or GPT.

Reading files needs no mounting. On a recognised partition, the context menu opens a browsable structure, from the drive as well as from an image file, and saves the selected files and folders onto another device. The readable file systems cover all three families:

  • Windows: FAT-16, FAT-32, exFAT, NTFS;
  • Linux: Ext2, Ext3, Ext4, Btrfs, XFS;
  • macOS: HFS+, APFS.

Support for Btrfs and Ext4 makes the tool useful well beyond the Windows machine: a drive taken out of a NAS or a Linux server can be read directly, without setting up the original machine.

Additional functions

The hex editor opens by right-clicking a drive or a partition. It displays and modifies the content of the sectors, with ASCII, UTF-8 and Windows-1251 encodings. It is the tool of last resort: manually correcting a boot sector comes down to a single byte, and a mistake cannot be undone.

The handling of Microsoft Storage Spaces identifies both the pool and its members, declared as Msft Space Device. A pool that has become unusable is freed by zeroing the partition table of its members from the context menu: the drives then become ordinary devices again.

What the tool brings, and its limits

Strengths

  • A single portable executable, with no installation and no trace in the registry.
  • Consistent diagnosis of hard drives, SATA and NVMe SSDs, USB sticks and memory cards.
  • A faked capacity test, rare in free utilities.
  • Imaging, cloning and image reading gathered in the same interface.
  • Reading of Linux and macOS file systems from Windows.

Limits

  • Windows 10 64-bit minimum, with mandatory administrator privileges.
  • No Linux or macOS version.
  • Several functions destroy data for good: confusion is expensive.
  • A USB-SATA bridge can hide S.M.A.R.T. and distort the diagnosis.
  • On a device holding irreplaceable data and showing signs of mechanical failure, no software replaces a laboratory.

For everyday use — checking the state of a drive before reusing it, testing a stick bought online, imaging a device before handling it, recovering a partition deleted by mistake — the tool covers the essentials with a readable interface. That is exactly what one expects from a rescue utility: to be ready on a stick, to install nothing, and to say clearly what it sees.

References

About the author

Jeremy Kraft runs the infrastructure and the self-hosted services of the IBCSC. These guides describe configurations that were actually deployed and re-checked before publication.

Ask a question All guides

Discussion

Comments

0

No comment yet. Feel free to open the discussion with a question or your own experience.