The other day, the worst happened. My beloved PC started lagging horribly out of nowhere, and after a reboot, it completely refused to turn on. It didn't take long to diagnose the culprit: one of my paired 16GB DDR5 RAM sticks had died. Given the current prices for good RAM, that hurt.

But after wiping my tears and pulling myself together, I decided it was too early to call the time of death. I wanted to try reviving the memory at the most obvious and simple level: checking the contents of the SPD chip. If the data was corrupted, the plan was to flash it with a verified dump read from the working twin stick.

For this exact purpose, a group of enthusiast repairmen developed and built this neat little device. It allows you to read and write SPD microcode simply by dragging and dropping a .bin file in Windows Explorer.

https://preview.redd.it/mhdi762ef0kh1.jpg?width=567&format=pjpg&auto=webp&s=1aac705e21a3f3df523dc8dc3f8f96338065e25e

The device is powered by an ARM STM32F401 microcontroller and housed in a custom 3D-printed case.

https://preview.redd.it/f48ubrhgf0kh1.jpg?width=567&format=pjpg&auto=webp&s=35bb53167a7087ee5e385382cd30ebc00d140605

When I read the dump from the dead stick, it immediately raised a red flag. The tool gave me a bad checksum warning: DDR5_CRC_BAD_6600 C34 Series.bin. Since the dead stick was part of a kit, its healthy twin was sitting right there in the PC and served as the perfect "donor" for a clean dump. I flashed the known-good SPD data onto the dead stick, and sure enough—the memory came back to life! It’s now back in my rig, working flawlessly.

Inspired by this little rescue mission, I decided to analyze both the healthy and corrupted dumps. I do a lot of low-level data recovery work, so I took what I learned here and added a new module to my own free for use diagnostic utility, Easy Disk Checker (previous reddit posts about it here, here, and here).

https://preview.redd.it/j6r70s1of0kh1.png?width=883&format=png&auto=webp&s=58e9e509f18e36bbbb2fe22befe27dcd1bf13d62

Now, in the data recovery branch of the utility, it can read and parse SPD contents for both DDR4 and DDR5. This is super handy for cases where you need to repair an SPD but don't have a healthy twin stick to pull a donor dump from. (Note: DDR ECC and laptop SODIMM memory are not supported right now).

https://preview.redd.it/v0l1fv7sf0kh1.png?width=883&format=png&auto=webp&s=e591d24dc7fc717a59e63806de4d2f07aca94c75

https://preview.redd.it/uolq7p6vf0kh1.png?width=883&format=png&auto=webp&s=a3bc6fb4196be0529c94be0c478b5dbd9200834c

Just a quick heads-up for anyone wanting to try this: you can't write SPD data directly to the RAM from a desktop software level for a number of reasons. You will still need an external hardware reader (like the one in the photo above) or a dedicated programmer with a socket and a soldering station.

https://preview.redd.it/vonnb75yf0kh1.jpg?width=425&format=pjpg&auto=webp&s=795e63e38740c4f3f85500a469620a8f0ebc7b4d

Since the last posts about Easy Disk Checker (free, multi-purpose disk utility), version 5.x has shipped with a brand new Data Recovery branch. As someone who's been doing data recovery professionally since 2003, I tried to build features that would help both regular users and myself in day-to-day work.

Easy Disk Checker datarecovery option

File recovery

Two goals here. With R-Studio sitting there as the industry flagship, I wanted to (a) not embarrass myself on the file-structure analysis side, and (b) add the options I personally kept wishing existed.

File recovery

The result is a modest "Smart Save" button that hides a fairly serious on-the-fly sorting algorithm. It's meant to cut down on the "I recovered my files but they won't open" support requests — common enough that we once had to write a whole article about it. The same heuristic kicks in for "Full search + RAW" mode.

Smart save option

Another classic mistake: people save recovered files back onto the same partition they're reading from, corrupt everything, and lose the chance to try again. Nobody reads warnings, so Easy Disk Checker just won't let you save to the source partition.

RAID recovery

Keeping with the "easy-style" theme — one-click virtual assembly of RAID arrays from disks or images. The program detects type and format from metadata, assembles virtually, and lets you browse the contents in a built-in explorer across all supported filesystems: FAT*, NTFS, Ext*, HFS/APFS, XFS, BtrFS.

Raid reconstruct

DVR/CCTV recovery

Same one-click approach for DVR/CCTV disks and images. There's an option to search for deleted or inaccessible recordings, and it works on disks that Windows "helpfully" initialized — the ones the recorder itself can no longer read afterward. Currently supports Hikvision (WFS 0.4) and LinuxGroupDVR formats, based on images users sent me. I'll add more as someone share more samples.

DVR recognizes

DVR structure open

Ransomware-encrypted disk analysis

This branch exists because of how often companies come to me with encrypted servers and workstations.

Ransomware analysis

The volume of these cases is genuinely alarming. And I have yet to see a server compromised by some elite hacker — every single case I've worked on came down to sysadmin negligence. A recent court ruling spelled it out: the contractors, mid-migration, set every password to "123456", handed admin rights to every account, then went off for the weekend. The database got wiped, 80% of the company's data was lost, and the court ruled the contractors liable.

Anyway — analyzing the system disk that initiated the encryption doesn't guarantee recovery, but it can sometimes get files back without paying ransom. The tool collects analytical data from every weakness and quirk I've seen ransomware leave behind over the years. It processes system and corrupted files directly, and also runs heuristics below the filesystem level. The output report is encrypted with a pub+pem keypair — no point handing the malware authors a free QA report on their bugs.

You can download the new version from the support page or install via the Microsoft Store, to keep the spam filters/automod happy, I'll put the download links in the comments. Bug reports and feature requests welcome — I act on them fast.

Since the last posts about Easy Disk Checker (free, multi-purpose disk utility), version 5.x has shipped with a brand new Data Recovery branch. As someone who's been doing data recovery professionally since 2003, I tried to build features that would help both regular users and myself in day-to-day work.

Easy Disk Checker datarecovery option

File recovery

Two goals here. With R-Studio sitting there as the industry flagship, I wanted to (a) not embarrass myself on the file-structure analysis side, and (b) add the options I personally kept wishing existed.

File recovery

The result is a modest "Smart Save" button that hides a fairly serious on-the-fly sorting algorithm. It's meant to cut down on the "I recovered my files but they won't open" support requests — common enough that we once had to write a whole article about it. The same heuristic kicks in for "Full search + RAW" mode.

Smart save option

Another classic mistake: people save recovered files back onto the same partition they're reading from, corrupt everything, and lose the chance to try again. Nobody reads warnings, so Easy Disk Checker just won't let you save to the source partition.

RAID recovery

Keeping with the "easy-style" theme — one-click virtual assembly of RAID arrays from disks or images. The program detects type and format from metadata, assembles virtually, and lets you browse the contents in a built-in explorer across all supported filesystems: FAT*, NTFS, Ext*, HFS/APFS, XFS, BtrFS.

Raid reconstruct

DVR/CCTV recovery

Same one-click approach for DVR/CCTV disks and images. There's an option to search for deleted or inaccessible recordings, and it works on disks that Windows "helpfully" initialized — the ones the recorder itself can no longer read afterward. Currently supports Hikvision (WFS 0.4) and LinuxGroupDVR formats, based on images users sent me. I'll add more as someone share more samples.

DVR recognizes

DVR structure open

Ransomware-encrypted disk analysis

This branch exists because of how often companies come to me with encrypted servers and workstations.

Ransomware analysis

The volume of these cases is genuinely alarming. And I have yet to see a server compromised by some elite hacker — every single case I've worked on came down to sysadmin negligence. A recent court ruling spelled it out: the contractors, mid-migration, set every password to "123456", handed admin rights to every account, then went off for the weekend. The database got wiped, 80% of the company's data was lost, and the court ruled the contractors liable.

Anyway — analyzing the system disk that initiated the encryption doesn't guarantee recovery, but it can sometimes get files back without paying ransom. The tool collects analytical data from every weakness and quirk I've seen ransomware leave behind over the years. It processes system and corrupted files directly, and also runs heuristics below the filesystem level. The output report is encrypted with a pub+pem keypair — no point handing the malware authors a free QA report on their bugs.

You can download the new version from the support page or install via the Microsoft Store, to keep the spam filters/automod happy, I'll put the download links in the comments. Bug reports and feature requests welcome — I act on them fast.