In the first part of this short series, I discussed the epidemic of counterfeit flash drives. Oftentimes, these counterfeits are flash drives of low capacity (4GB or less) that have been packaged and electronically tweaked to appear as if they were much higher capacity drives. I noted that I received three ’32 GB’ Flash drives from an eBay seller. In this second of three blogs, I’ll go over some of the tests that can be used to confirm that a flash drive that is suspected of being counterfeit can be proven to not be as advertised.
If you have a Windows PC, the simplest test is to simply open File Manager, a component of Windows and select the flash drive. Right click on the drive, and select ‘Properties.’ This will show what capacity the drive is telling File Manager that it has. This should be the capacity of the drive you purchased. Next, copy two or three gigabytes of data onto the drive. In many organizations, your logos and a few reports may be enough to reach this level. If your drive has not been ‘hacked’ to look larger, recording the files should go fairly quickly. A counterfeit drive often takes many hours for this ‘small’ amount of data.
Next, select the drive in File Manager, and right click on it once more – select ‘Properties,’ and then select Tools. When Tools opens, tell Windows to scan the disc for errors – if the flash drive is authentic, there should be no errors – a counterfeit drive will often show many errors (file not found, etc.). The reason that these errors occur is that the actual capacity of the counterfeit drive is often less than 2 GB, but firmware in the flash drive makes it report more than actually exists. When you try to copy more than the drive’s actual capacity, there’s no place for the data to go – so when you scan the drive, scan disc won’t be able to find the files on the flash drive. Keep in mind that testing a drive using 2-3 GB of data is just a recommendation that I feel will uncover a majority of the counterfeit cases out there. Copying more data might be needed to show problems in some cases, but 2-3 GB provides a fairly reliable, quick test.
If you want more verification that your flash drive is no good, a free program called h2testw_1.4, developed in Germany (and downloadable here) and other locations, writes to the media, and also reports on problems with the media. It’s written in German, but there’s an English interface.
The application asks you to select a target (the flash drive). It asks if you want to write and verify the entire drive, and also provides the option of telling it how much data to write and verify to the drive. If the drive is supposedly 16, 32, 64, or more GB in size, a write test of just 128 MB may be enough to show problems. Reports of counterfeit flash drives indicate that they’re usually hacked 1 GB or 2 GB drives – though there have also been reports of hacked 4 GB drives also being used. The choice of whether to run H2testw with 1024 MB,2048 MB, 4096 MB or more is up to you – if you are willing to wait for more than 4 GB to be written to the flash drive, your chances of NOT detecting a counterfeit drive are very low; running the quicker 1 GB and 2 GB writes may not find a counterfeit made using a 4 GB chip, but the time saved may be worth the risk of missing a bad, larger drive. Also, in our tests, some counterfeit flash drives even failed a 64 MB H2testw test. The test interface looks like this:
Even writing and verifying as little as 128 MB to a counterfeit drive can reveal problems when the program tries to verify the written data. Problems, even after writing just a few hundred megabytes and stopping the test are shown here:
My suggestion – if you are really concerned that a flash drive is counterfeit, or just don’t trust the supplier, H2testw is an effective way to do a test of the drive that File Manager isn’t designed to perform. It’s also pretty fast, if you don’t want to fill the drive with data. If, on the other hand, you don’t have (or don’t want to run) H2testW, File Manager (and the disk scanner built into it) can check the drive’s integrity after writing a few gigabytes of data to it. Rule of thumb: if it seems to be taking an inordinately long time to write your files to the drive, test it – counterfeit drives often take longer than normal to write to – and don’t even bother trying to read from them – your data may not be there.
In the third and final part of this series, I’ll discuss what to look out for when buying flash drives – or flash memory – for your organization.By Mark Brownstein