Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been given some flash drives that appear to be fake. The silk screen says 64 gigs, and they show up as 64 gigs to the OS.

However if you attempt to write any files larger than 4 gigs the file becomes corrupted.

How can you quickly tell if a flash drive / sd card is fake, and what the actual size is?

Side note:
I know about h2testw, but it is in german, and I find it extremely difficult to use. I'm looking for an alternative program, or a way to do this from the command line.
Any platform is fine.

share|improve this question
5  
Your conclusion is most likely incorrect. They're not fake, they're just formatted with a filesystem that doesn't support files over 4GB. Most flash drives are shipped this way. –  David Schwartz Aug 14 '13 at 8:09
    
Actually, I'd expect the OS to spit out some error message or warning, rather than just writing a corrupt file (but this might be down to the individual program). At least in Windows Explorer you can't simply drag&drop too large files on a FAT32 drive. –  Mario Aug 14 '13 at 8:28
    
Not neccessarily - my experience is exactly this - 128 fake disks with 4 gigs flash. –  davidgo Aug 14 '13 at 8:28
    
exFAT supports files up to 16EiB in size. But obviously not on a 4GB card. –  Ignacio Vazquez-Abrams Aug 14 '13 at 10:43

3 Answers 3

up vote 12 down vote accepted

Open the card device directly, and write 0x00 to it up to the capacity on the label. Write 0x55 0xff 0xaa to the first three bytes, and look for any non-0x00 byte up to the capacity on the label. If you find one, the card is either fake or defective. If you find 0x55 0xff 0xaa... definitely fake.

dd if=/dev/zero of=/dev/mmcblkX bs=16M count=...
echo -e -n '\x55\xff\xaa' > /dev/mmcblkX
hexdump /dev/mmcblkX
share|improve this answer
    
This is quite clever –  Mark Henderson Aug 14 '13 at 1:48
2  
Would it be possible to have more details ? Like why 0x55 0xff 0xaa and not an other sequence ? I'm quite interested. –  Levans Aug 14 '13 at 7:45
    
@Levans its because 0x55 = 01010101 0xff = 11111111 0xaa = 10101010 –  exussum Aug 14 '13 at 8:14
    
though im not sure why if you find what you write it would be fake –  exussum Aug 14 '13 at 8:23
3  
It's just a specific pattern you can find again. The idea is rather simple: first you set everything on the drive to 0, which means all bits should be 0. Then you only modify the very first 3 bytes. If all other bytes stay 0, they're indeed there. If other bytes change as well, the drive is defective (didn't write or read properly). If other bytes are the same, the drive is in "looping" mode, meaning, if you write over the end (which is closer to the start than expected), it will start writing at the beginning again. –  Mario Aug 14 '13 at 8:25

Given that the problem shows up at filesizes of 4GB what file system is in use on the card?

If it is FAT32 the problem you are seeing might be caused by FAT32 having an upper file size limit of 4GB. See http://en.wikipedia.org/wiki/File_Allocation_Table#FAT32 for more information

On Windows you can identify the file system by right clicking on the device in "My Computer" and selecting properties. Look at the "file system" field.

share|improve this answer

I recently found a program Scanflash - http://www.shikadi.net/scanflash/ which scans a disk under Linux, finds out if its fake and partitions the useable areas. It takes a long time though. (Like a full day on a 128 gig fake flash)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.