Faked Memory Sticks

by davecs
from his blog, Random Thoughts From My World

There is a big trade in cheaper memory sticks, that is, all types. These include both USB Pen Drives and SDXC and microSDXC (aka TF) types. But there are many others. Some cheaper ones have speed problems, and if that's not a concern, go ahead. But amongst them are a number of Fake Memory drives. Let's just explain what that means.

A fake memory drive is a memory drive, it's the details that are faked. It will actually work up to a point. What has been faked is the amount of storage space it holds. Your computer or phone or whatever device using it, relies on information stored at the beginning of the memory to know how much space there is on it. Also held there is the file index system. If someone can overwrite that information, then the drive can return false data to the system about how much space it has.

Writes to space that doesn't exist

Suppose you have bought, like I did, a drive advertised as 128Gb, which actually held only 32Gb. When I put stuff on the drive, it would use the storage space in sequence, and would appear to work until the 32Gb was full. After that, things would start to go wrong. There are at least two possibilities after that, there may be others. Stuff written to the drive may well be written to space that doesn't exist, or it will be paged so that it will overwrite existing data by sharing each location on the drive with 4 or 5 different addresses. Either way you will lose data.

In the case of the one I had, it was the first of these. When verifying data, the first 31 or so Gb was read back OK, but everything after that was lost. If it was the other type, it would be the last data that could be read back.

I tested the drive with a simple Linux program called f3. It's a text program that runs in a terminal. There are two commands, f3write and f3read. You have to type in the path to the disk you want to test. So, if the disk appears on the path at /media/3463-3531 (your file manager will give you this information), you type this line into your terminal:

f3write /media/3463-3531

It will take a very long time for this command to finish running, but if you leave your file manager open at the disk path, you might see something like this:

Files are written in sequence from 1.h2w until the disk's file index system says it's full. Now you may notice that the icon of each file changed from 33.h2w, well that tells you that the File Manager is seeing the contents of the file, as a different file type. That's a warning!

f3read /media/3463-3531

And this is an excerpt from the text that appears in the terminal:

Data is organised into 4 columns, after the three dots. The first number represents the number of sectors that are OK. The others are corrupted, changed and overwritten. Basically anything not in the first column is a fail. If a line contains a few sectors not in the first column, but afterwards everything goes back to normal, it might indicate a damaged area on the disk. It might be possible to format the disk so that those sectors are not used. But in the readout above, the reading for file 32.h2w means that there were 1941312 real sectors left on the drive, and 155840 were not there, and every line after that means that program was trying to read back from sectors that simply were not there!

If you get a reduced number of sectors in column 1, but zero in the others and no more lines after that, it just means that it's the end of the space. Sometimes you get an error report speculating as to why it stopped, for example, that the drive may have overheated. That happened to me when testing a good drive, but the File Manager told me the disk was now full, so there was nothing to worry about.

Another Clue

This paragraph is a bit technical.

One of the "features" of all storage devices, is that the amount of actual space you can write to, is a rather less than the amount advertised. The drive info, table of contents, and the formatting itself take up space. One of the features of Thunar, the file manager used in the XFCE4 desktop, is that by default it records Kilo, Mega and Giga bytes as 1,000, 1,000,000 and 1,000,000,000 respectively. A true Binary Gigabyte is not 1,000,000,000 but 2³⁰ which is 1,073,741,824. The graphic is a screenshot of Thunar, showing two devices plugged in. One reads 134Gb, but in true binary Gigabytes, that would be 124.79Gb. Although under 128, it's unrealistically high. So in trying to make their fake product look good, the people who have faked this drive have over-egged the cake a little. The one showing as 128Gb will have a binary size 119.2Gb which is more realistic.

Outcome

I sent in a request via Ebay to the seller of the fake drive, for it to be returned. They accepted immediately, which stops me making a complaint, and the drive I bought is still for sale. So be careful out there.