4 Tools to Test and Detect Fake or Counterfeit USB Flash Drives
There are plenty of fake and counterfeit products around and the world of computers is not exempt. In recent years one area has become more prone to this than any other, and that is flash memory storage. Devices such as USB flash drives, SD/CF cards and even SSD drives have been affected by this problem. Counterfeit USB flash drives seem to be the most common though, there’s so many different types, capacities and speeds that it’s easy to hide them among all the real products.
You may think this problem only affects places like eBay but even Amazon and other legitimate retailers have been caught out too. This is why it’s a good idea to check any flash device you purchase is the product you paid for. Making sure the serial or code number on the stick is legitimate is one way, another is making sure the drive is the size advertised because most fake drives have a lower real capacity than listed by using smaller and much cheaper memory chips. The drive may even be reported as the right size in windows.
Software developers are also aware of this and some have written tools to help you identify if a drive is smaller than you expect and is therefore likely to be counterfeit. Here we have listed 4 for you to try that are designed to check for fake size drives. 1. H2testw
For several years H2testw has been known as THE tool for checking memory based flash drives to see if they are the correct capacity. The problem is it was developed several years ago and the last release was way back in 2008, flash based media is available in much larger capacities now and a scan with H2testw can run into several hours because it hasn’t been optimized to run on big drives.
The method used in H2testw, while very slow is still one of the most thorough ways to scan the drive for a fake capacity. It isn’t a fully destructive test because it only checks the free space on the drive, but the best way is to use H2testw on a cleanly formatted device, that way it will be checked completely from the first byte to the last. It works by writing large 1GB files to the free space and then reading them back, the idea being if the read data isn’t the same as what was written, there’s a possible issue.
After it’s done the software leaves the test files on the media, you can erase them if you like or verify them again. If you have the time and want a very thorough test, try H2testw, if not try something that works a bit quicker first. H2testw defaults to German language but you can easily change it in the GUI.
2. FakeFlashTest
The FakeFlashTest utility is from the developer of the RMPrepUSB multipurpose USB booting suite. One component of the RMPrepUSB program is a small and quick test to check your drive and its real capacity, this is an extended and enhanced version of that which has been released as a standalone executable. Unlike many other tools of this type, FakeFlashTest is quite new so includes optimizations and methods better suited for today’s flash media.
FakeFlashTest tries to fix the main issue with H2testw which is the incredibly slow time it can take for the process to complete on larger and slower flash drives. The first test you can run is similar to the one found in RMPrepUSB and a quick test. This writes and reads 512 bytes of data at set intervals across the drive and so finishes in less time. The second test is very similar to H2testw and writes/reads to all free space on the drive but has been optimized in a number of ways to complete the task much quicker than H2testw.
Do note that the the quick test is destructive meaning anything on the drive will be overwritten, so make sure your files are backed up. The slower test is not meant to be destructive but can still corrupt your files if they are on a bad area of the drive.
3. USB Flash Drive Tester
USB Flash Drive Tester is listed by its developer as a generic tool for testing flash drives or SD/CF cards but is especially useful for detecting counterfeit drives with a fake capacity. It works in a similar way to H2testw by writing data to the device, reading it back and then comparing the two for differences. Any errors indicate a problem with the drive.
To run a full test select your flash drive from the drop down and a test type of “write, read and compare”, then start the test. If you don’t have the time to run a full test on a large or slow drive, the data can be written to the drive now and compared later on. Like H2testw this is getting a bit old and comes from 2009, it also requires installation.
Download USB Flash Drive Tester
4. ChipGenius
The programs listed above all work in the same way which is to write data onto the disk and then read it back to see if the data is correct or corrupt. ChipGenius is completely different and actually doesn’t touch the data on the drive at all but instead reads the information from the flash memory chip inside it to see what it is and what it’s true size should be. This might not work all the time but for the majority of counterfeit devices it should work as intended.
Simply run the program and look for the information about the flash chip inside your device, a line will give the vendor and model number of the chip and it’s true capacity. If your flash drive is supposed to be perhaps 64GB and the Total Capacity listed is much less than 64GB, then it’s likely a fake drive. Right click in the window to copy the data to the clipboard if you want to manually search or find out more about the chip inside your drive.
Download ChipGenius (Russian site) Direct Download of ChipGenius
I use ChipGenius to get a fast response and then check with some images.
I copy many images to the drive and then some images start scrumbling.
TEST.BAT (Batch file for WIN10):
FOR /L %%A IN (1,1,9999) DO (
COPY Image_20000.bmp F:\%%A.bmp
TIMEOUT 60
)
FakeFlashTest always seems to crash during the reading portion of the test, at which point is dependent on the fake flash drive in question I think, had it stop responding at 95% complete, 90% and latest at 30%. Let the window stay around for a couple hours just in case, but it seems once it goes Not Responding it stays that way. And it takes 4hrs or so just to get the point where it crashes. How has anyone progressed to complete the test? Can the test somehow be resumed if the task needs to be killed? Is 2TB just beyond this test applications capability?
HAve a supposed 1TB flash drive…It is taking over 100 hrs for H2 to complete the test…There has to be a more efficient way to check for capacity…
Yes, use FakeFlashTest’s Quick Size Test. But if also want to test the flash memory quality, there’s no way to speed it up.
Beware of ChipGenious. VirusTotal and numerous other sites list it as malware that installs a backdoor.
I’ve seen no evidence that the results at places like VirusTotal are anything other than false positives. It’s been the same way for years.
Anybody can create a simple program with just a “Hello world” message box and produce more detections in VirusTotal than ChipGenius. That’s how unreliable those services can be these days.
Regarding the malware triggers for ChipGenius, if you look at the actual details of a VirusTotal scan, you will see that there are multiple generic detections based on Heuristics, but not really any specifics.
This means the software does something the antivirus vendor considers suspicious or dangerous, not that it’s actually malware.
False positives are very common with software that does certain low-level operations such as manipulating device drivers or opening network ports.
They also often happen when software is created using certain tools that also happen to be used by malware frequently. The AutoIt3 script compiler is a valuable, flexible and important administration tool, but because it has been used maliciously in the past, programs compiled with it often get flagged as malware.
UPX compression is a useful tool, but it is also often used by malware authors, so innocent programs that use it sometimes trigger false positives.
It’s right and reasonable to be suspicious of any software that triggers a malware response. There have been cases where real legitimate software was infected with malware, so it’s not impossible, but if the program is well-known and has been around for a while, and other people say they trust it, you can probably assume it’s a false positive.
Always get software from the original sources whenever possible. Don’t download software based on results of a Google (or other search engine) search, as there are often fake or misleading links.
Look at the reputation of the program and how long it’s been around.
Yes ChipGenius is not detected as malware by bitdefender but as malware by other antivirus (Smadav). It checks total capacity very fast (almost instantaneously) on fake USB. On Dual USB Sandisk 3.0 128 BG (OTG) original it ,ChipGenius couldn’t detect total capacity in normal detection but it recommended “forced detection”. But I didn’t excecute it to avoid damage to my files. I bought Flashdisk 3.0 Toshiba 64 GB but total capacity according to ChipGenius is only 512 MB. Description: [D:]USB Mass Storage Device(USB2.0 Flash Disk)
Device Type: Mass Storage Device
Protocal Version: USB 2.00
Current Speed: High Speed
Max Current: 100mA
USB Device ID: VID = 1221 PID = 3234
Serial Number: 2016112614400062
Device Vendor: USB2.0
Device Name: Flash Disk
Device Revision: 0000
Manufacturer: USB2.0
Product Model: Flash Disk
Product Revision: 2.60
Controller Vendor: Micov
Controller Part-Number: MW8209(MXT6208E)
Flash ID code: 2CBC9066 – Micron MT29F4G16ABBEA – 1CE/??? [SLC-4K] -> Total Capacity = 512MB
Hint: : Please exit this program and RE-PLUG your USB Flash Drive before you can operate it!
Result of test on original Dual USB Sandisk 3.0 128 BG (OTG):
Description: [D:]USB Mass Storage Device(SanDisk Ultra)
Device Type: Mass Storage Device
Protocal Version: USB 2.10 <- Hint: This device can run faster when plugged to a USB3.0 port
Current Speed: High Speed
Max Current: 224mA
USB Device ID: VID = 0781 PID = 5590
Serial Number: 4C531001621217117105
Device Vendor: SanDisk
Device Name: Ultra
Device Revision: 0100
Manufacturer: SanDisk
Product Model: Ultra
Product Revision: 1.00
Controller Part-Number: Unknown
Beware of fakes Transcend Jetflash 700 on eBay.
here the result (256GB):
h2testw :
The media is likely to be defective.
15.1 GByte OK (31771168 sectors)
234.8 GByte DATA LOST (492488160 sectors)
Details:0 KByte overwritten (0 sectors)
0 KByte slightly changed ( Total Capacity = 16GB
Tools on web: dl.mydigit.net/special/up/alcor.html
Possible Flash Part-Number
—————————-
Unknown
Flash ID mapping table
—————————-
[Channel 0] [Channel 1]
AD3A14AB424A ——–
——– ——–
——– ——–
——– ——–
FAKEFLASHTEST v1.1.1 [SSi]
DRIVE 1 – 249.0GiB Generic Flash Disk
FFT – Quick Size Test (destructive)
D: (no label) DRIVE 1 – 249.0GiB Generic Flash Disk
Writing marker blocks to drive 1
5% complete – 1 min 35 sec remaining
10% complete – 1 min 21 sec remaining
15% complete – 1 min 20 sec remaining
20% complete – 1 min 12 sec remaining
25% complete – 1 min 9 sec remaining
30% complete – 1 min 3 sec remaining
35% complete – 1 min 0 sec remaining
40% complete – 0 min 54 sec remaining
45% complete – 0 min 51 sec remaining
50% complete – 0 min 45 sec remaining
55% complete – 0 min 41 sec remaining
60% complete – 0 min 36 sec remaining
65% complete – 0 min 32 sec remaining
70% complete – 0 min 27 sec remaining
75% complete – 0 min 23 sec remaining
80% complete – 0 min 18 sec remaining
85% complete – 0 min 14 sec remaining
90% complete – 0 min 9 sec remaining
95% complete – 0 min 15 sec remaining
100% complete – 0 min 1 sec remaining
Reading back marker blocks…
5% complete – 1 min 54 sec remaining
10% complete – 1 min 48 sec remaining
15% complete – 1 min 42 sec remaining
20% complete – 1 min 36 sec remaining
25% complete – 1 min 30 sec remaining
30% complete – 1 min 24 sec remaining
35% complete – 1 min 18 sec remaining
40% complete – 1 min 11 sec remaining
45% complete – 1 min 5 sec remaining
50% complete – 0 min 59 sec remaining
55% complete – 0 min 54 sec remaining
60% complete – 0 min 48 sec remaining
65% complete – 0 min 42 sec remaining
70% complete – 0 min 36 sec remaining
75% complete – 0 min 30 sec remaining
80% complete – 0 min 24 sec remaining
85% complete – 0 min 18 sec remaining
90% complete – 0 min 12 sec remaining
95% complete – 0 min 6 sec remaining
Memory tested in blocks of 25600 sectors.
BAD MEMORY from sector 31814074 (15,534.0MiB) to sector 524281274 (255,996.0Mib)
WARNING: no memory detected at one or more locations.
Test took 1252 seconds.
*** FAILED ***
DEVICE HAS DUPLICATE OR BAD BLOCKS!
Recommended maximum usable partition size: 15,521.0Mib (approx. Last good Sector=31814074)
H2testw gives me correct results: good drives are either 100% good or a trivial 11K bad, and a known fake drive that lost data was 2G good/30G bad.
FakeFlashTest didn’t work for me. It said all my flash drives are bad, even the ones that I know are good.
There is another,, open source, there is a git,, F3
F3 probe 6.0
Copyright (C) 2010 Digirati Internet LTDA.
Runs on linux,, relativly fast
Last run on a 64G evo+
Probe finished, recovering blocks… Done
Good news: The device `/dev/sdb’ is the real thing
Device geometry:
*Usable* size: 59.69 GB (125171712 blocks)
Announced size: 59.69 GB (125171712 blocks)
Module: 64.00 GB (2^36 Bytes)
Approximate cache size: 0.00 Byte (0 blocks), need-reset=no
Physical block size: 512.00 Byte (2^9 Bytes)
Probe time: 8’26”
I tried all 4 and they do check the size but -NONE- of them “Detect Fake or Counterfeit Flash Drives”.
.
A fake or counterfeit flash drive says it has xx amount of storage but actually contains much less, that’s the reason the fake exists. That is exactly what these tools tell you, whether you’ve got the storage you paid for or a fake capacity.
It would be highly unlikely to get a fake flash drive with the full amount of storage, it wouldn’t be worth the fake manufacturers time.
I am using H2TestW for long time, actually it only check the capacity, writing and reading from disk.
May be you have all good quality cards/flashes.
If you insert Fake card and check with H2TestW, the moment when it can’t write/read the area, its screen will be RED and give you the final result at end of check.
Chipgenius reported as malware/virus by Microsoft Security Suite. October 2016.
False positive…
Hi, This may sound counter intuitive, but I would like to do the opposite and reduce the reported size of an SD card. I have an old synthesizer that was only designed to access SCSI hard drives of 80MB or less. Recently I purchased a SD / SCSI adapter and when the synth tries to format an 8GB SD Card, for example, in the adapter, the synth complains that the capacity of the “hard drive” is invalid. The method the counterfeiters use presumably is to take the MBR partition table of a larger card and write it to the MBR of a smaller card, but this would not work for the synthesizer, as the disk format is proprietary and there are no partitions. Is there a way to tell the SD card at a lower level that it has fewer cylinders etc.? Failing that I am left with reading / writing disk images within Windows / Linux, which works, but can be cumbersome and risky!
I dont know of any way to alter the reported capacity of an SD card.
You can use RMPrepUSB to write disk images. In it’s default setting, it will only list USB devices.
realy late comment:
you can try to make 2 partitions on the sd card(dont know good software, but linux is always good)
A good Windows Software is the MiniTool Partition Wizard. Just create the first partition the size you want and leave the rest unalocated.
This is also a good method of using fake capacity drives.
Find the actual number of sectors using h2testw or F3probe then put this good area into one partition and leave the fake area unallocated.
Most of the cheap flash drives on eBay are 8GB ones faked to look much bigger.
Hi Andy,
Maybe your problem is resolved in the meantime, but you can try this for your old synthesizer: buy a 2 GB SD card, or less. In those time, the greater capacity addressable was 2 GB. Then SDHC (High Capacity) was created, giving access to 4 GB and more of storage. Older systems don’t works with SDHC, so stay with 2 GB or less for your older synth.
H2testw made my 64GB micro sd card usable space from 59.6 GB to 58.2 GB. Can I restore capacity that I had before using this program?
I have ran this program many times, there is a file from the program still on there that you must not be seeing. The best way is to back everything up and then format the card. This will fix your problem. BUT BE SURE NOTHING IS ON THERE, for which you will lose it if you don’t.
reformat the pendrive with original filesytem.. for example…. if it was fat32 and now its is NTFS change it back to fat32
remeber you wont be able to save files over 4 GB on fat32
Thanks 4 this info I’m a bit of a tech-head and a bit of a perfectionist. I don’t mind waiting as long as I get accurate information. Will probably download 50% of these programs (when I get my comp back) to TOTALLY make sure I’m getting what I paid 4. Let U know on all programs.
guys the h2testw doesnt work on unformatted sd card but the if the sd card is not formatted it cannot run and i cannot know exact size and i cant fix it
Chipgenius has a virus, per mcafee….
False positive, McAfee’s famous for false positives…
Same for Panda, which don’t have a bad reputation for false positives
Thanks! But it should be noted that ChipGenius is only useful for USB flash drives, not SD flash cards.
I really thank you!
Gergely
Nice Post. thanks
thanks ……… makes me more comfortable knowing i have a real 16gb memory (speacially since i bought it from ebay!)
thanks for the information. If it wasn’t for you I would have got my self a fake.
Thank you so much for this.
Thanks for the tips .. is really a good one
thanks for the post ray……now i can always be sure about my pd
Very useful, thanks Raymond
Thanks for this, as always.