How to: Detect fake pendrive / memory card
Webshops and users on auction sites frequently attempt to sell fake pendrives, fake SD cards/memory cards and even fake hard disk drives. Attempting to store (and especially backup) any data on these devices could result in complete, unrecoverable data loss, so it is better to avoid them and verify if our device(s) are real, valid and they work as expected: the complete capacity should used safely to store our valuable data.
Pendrives - need to select carefully
What is a fake pendrive?
A fake pendrive (or an above mentioned different fake storage device) shows itself as a high capacity storage (disk drive). For example, one of such fake pendrives is identified as General UDisk device with the capacity of 125 GBytes in both Hard Disk Sentinel and in Windows Disk Management, pre-formatted as FAT32 file system:
The total capacity of the pendrive seems 125 GBytes (134,217,728,000 bytes)
The total capacity of the pendrive seems 125 GBytes, formatted and "Healthy" according to Windows Disk Management
The pendrive seems usable: we can save some data on it and generally it is working correctly. However, when we attempt to use it for real storage of several GBytes, it may become unusable or "just" the saved data may be damaged/lost. The most common symptoms are:
file(s) and/or folder(s) may be not readable or damaged/corrupted: the contents of the files are empty
the pendrive may be completely disconnected from the system (just like if we'd remove). Sometimes it can be reconnected but in other cases, the pendrive may no longer working, causing complete data loss
Typical signs of a fake pendrive or SSD
Typical fake pendrives/SSDs may show very generic model ID on the Information page, with no real information about the manufacturer or the model. Very typical fake SSDs may show VendorCo ProductCode, General UDisk, or just SSD but with no further details. Also they may show very generic vendor/product identifiers, for example VID: 048D, PID: 1234, VID: 048D, PID: 1111 or something similar. It is common that these fake pendrives/SSDs do not report any kind of health / temperature information (no S.M.A.R.T. attributes reported, so the S.M.A.R.T. page is completely empty).
If you see VendorCo ProductCode in Hard Disk Sentinel, there is good chance that you have a non-working (fake) pendrive or SSD.
How to diagnose and verify a possible fake pendrive?
By using the Disk menu -> Surface test -> Read test function of Hard Disk Sentinel, we can perform a complete read scan, to verify if all sectors could be read. Most fake pendrives always disconnect when we attempt to read a certain sector (or any sector beyond that) as we can see on the resulting disk surface map:
The pendrive always disconnects when we attempt to read a sector outside the safe range
This means that until we save about 8 GBytes (626 blocks x 12.80 MBytes), we are probably "safe" (but we can't say this for sure, there is no warranty that the files always located in the first part of the surface) but as soon as we reach this limit, data loss happens.
Next generation fake pendrives
Because this situation can be easily revealed (just some minutes in Hard Disk Sentinel), the next generation of fake pendrives work in a more sophisticated way: all sectors could be read and written (!) so we may assume the complete capacity can be used without problems. But this is not true: only part of the sectors really store the actual data - and the rest of the accessible sectors do not "hold" what we save, they always return zeroes.
This can be also verified by a different test of Hard Disk Sentinel Professional which can confirm that all sectors of the disk drive can be both written and read back - and the sectors contain exactly what the test wrote previously. Please note that this a destructive type test (clears all data) so use only when the pendrive (or the disk drive to be tested - as this can be used on both hard disks, pendrives, memory cards or other storage) is empty or after a complete backup.
To detect, verify and confirm if the pendrive is a fake:
select Disk menu -> Surface test and select the device
select WRITE+READ test but do not start the test yet
select the Configuration tab in this window and on the right, select Write pattern = Random data
then start the test. It will overwrite all sectors with random data and then verify if the data could be read back and we receive back the REAL data what we wrote. Fake pendrives/memory cards would work this way:
all sectors can be READ without problems (including sectors which are normally not available for real data storage)
all sectors can be WRITTEN without problems (including sectors which are normally not available for real data storage)
non-existent / not valid sectors could be quickly read back (due to an internal cache) with real data, but if we perform complete overwrite and then read back the data (or after a power cycle), we always get different results, not what we wrote. Usually we receive empty sectors (all 00 bytes).
Let's see a fake pendrive for example: it is advertised/offered as a pendrive with capacity of 16 GBytes. The above method reveals that only about 9 GB usable: only the first 9 GB (and some blocks on the end) seems valid, green. Other (red) blocks are readable, write-able - but they do not hold the data we wrote previously, so we receive high number of "verify errors" during the surface test. If you click on the disk surface map, you can inspect the contents of any sector: this clearly shows the random data we wrote (when clicked on a green block) or an empty data/all zeroes (when clicked on a red block).
Write+Read test performed to verify which sectors can actually hold the stored information
Clicking on a GREEN block shows what the disk test of Hard Disk Sentinel Pro wrote: the random data
Clicking on a RED block shows that the sector is empty, it does not contain what the disk test of Hard Disk Sentinel Pro wrote in that sector
Fake hard disk drives
Some sellers offer "high capacity USB removable external hard disk drive" for sale. Some of them are even not a hard disk drive, disassembling the enclosure (box) of the external hard disk drive reveals the internals: inside the box, we can't find a hard disk drive but only a such fake pendrive and the USB cable/connector is simply wired. (This is my personal favourite from the fake devices.)
These "hard disks" can be also tested and quickly revealed as fake by the above methods.
Why these devices can work (at least partially)?
In almost all cases, these pendrives, memory cards, "hard disk drives" are pre-formatted with FAT32 file system. The administrative area (File Allocation Tables (FAT), root directory and so) are located in the first sectors of the disk surface and when we copy files over the disk drive, it starts to fill up from the beginning. This is why until we reach a certain capacity limit, the device seems usable for file reads/writes but we may not notice if a file is really saved or not: imagine if you save a bigger file on the pendrive but when you read back, it contains all 00 bytes instead of the real data. You'd end up empty/blank images/photos, music, video files or even missing company/business documents.
In contrast, NTFS file system works differently, where the administrative area (MFT) is not located on the beginning of the disk drive. The MFT and special NTFS files would be saved to the middle of the disk surface (where the fake pendrive does not able to hold data), so formatting a such disk drive to NTFS usually fails with error. If a such external hard disk drive is offered as "only FAT32 supported, does not support NTFS" then you can absolutely sure that the external hard disk drive is fake: it means that the NTFS metadata can't be saved/loaded/managed by the system at all.
Sellers assume that you'll not notice this situation - as it may take relatively long time to fill a pendrive/SD card with 128 GBytes capacity or even more. But using a such pendrive (or especially a such fake memory card in your mobile/tablet/camera) can cause unrecoverable and complete data loss. Imagine seeing 1000's of empty/corrupted photos after arriving home from a fantastic holiday....
Practices to avoid fake pendrives, memory cards, hard disk drives
Always buy/order storage devices from reliable sellers and select good, brand models.
Avoid selecting very cheap, unbranded devices with no real company/manufacturer labels even if they seem "good buy" or "good offer"
Avoid selecting hard disks offered as "only FAT32 support", "does not support NTFS" or similar
Always test the pendrive, memory card or external hard disk drive carefully before using for real storage: by the above mentioned tests (and/or if you select a hard disk or SSD, then you can test with other methods too as suggested at How can I perform a deep analysis?
If you see the disk name in Hard Disk Sentinel as "General UDisk" or just a "?" or "Hard Disk Device" or similar, the situation is at least suspicious. Quality pendrives usually provide a valid model/name (which may even contain the name of the manufacturer too).
Be careful: with the evolution of such fake pendrives, we may expect even more weird things: we may expect new fake devices where the "working" area is bigger and/or located differently (for example to work when formatted as NTFS too). If a quick test tool (or simply saving/reloading some files) seem working fine, the ONLY sure way to detect/confirm fake storage device if you test all sectors of the device for reading/writing with verification. This is an easy test to do with Hard Disk Sentinel Pro.
Do you have any similar or different special (fake) pendrive, memory card, internal/external hard disk which may work differently than the devices described above? Feel free to drop a mail to info@hdsentinel.com address with the details. Looking forward to introduce other beauties too - to allow us the opportunity to AVOID buying/using them and avoid the headache and data loss may be related to them.