Thursday, February 4, 2010

Check storage capacity of fake USB flash drive

Hi,

I also bid for one of those wonderfully inexpensive massive capacity flash drives and received an USB flash drive that tells me it's 8 GB. But in fact it's not. It only holds 4GB of capacity.

My flash drive was labeled with an 8GB checkmark on the box and an 8GB sticker on the stick itself. Very promising. And when I plugged it in, my Antivirus program reported the virus win32:Perlovga and a Trojan-Downloader named Win32:Small-btx found in the two files copy.exe and host.exe that were both stored on the stick. The autorun.inf also stored on the flash drive tried to infect my computer system by executing the copy.exe command.

My USB stick is formatted with FAT32 and is an Alcor USB 2.0 model. The product shows itself as 8GB under Windows XP.

Besides, the product was advertised with a data writing speed of up to 7 MB/s. In reality it is much slower (yes I have USB 2.0 :) and writes data only with 12 MB/s (maximum).

Ok, here is how I checked for the stick's capacity, read and write speed and found out that mine is a fake:


1. Download the free version of the tool
Bart's Stuff Test 5
Version 5.1.4
(search for this with google, I am not sure if I am allowed to post a link here)
2. Don't plug in your flash drive yet.
3. Disable the Autorun feature of Windows XP first.
4. Plug the stick into an USB port (Warning: have your Virus signatures of your antivirus program updated first, just in case).
5. Don't open anything on the stick. Do not doubleclick on the stick.
6. Format the stick to get rid of any potential viruses or malicious tools.
7. Run Bart's Stuff and select the stick under "Folder"
8. Start the test. It will write a sequential file that will fill the stick up to > 90% of it's capacity and then it does read back the written data.
9. Check the Bart's stuff status written total when you get an error message like this: "An Error occurred. WriteFile returned an Error. There is not enough space on the disk".

My stick ran out of space at 4 GB exactly, Bart's Stuff filled the stick up to 52 % of it's fake capacity. But: Since the FAT32 maximum supported file size is 4GB, this method would not work on flash drives with more than 4GB of capacity. Larger size sticks should be filled up with large files that are compared against their originals to see if some errors occur.

But I found another indication that proves the stick I have is a fake:

Windows XP sees it as 7.95 GB capacity with 8,539,680,768 bytes. This is too much reported space.

I also own a non-fake 8GB flash drive (not an ebay deal). This real 8GB stick is reported by Windows XP as 7.73 GB capacity with 8,304,717,824 bytes. Since flash drives always give you less than the advertised storage space, this 7.73 GB seems to be about right for my real 8GB flash drive.

Next step if you own a fake flash drive: If you can, file a complain with paypal to try to get your money back.

There is another very useful utility that can help to check for fake USB sticks, it's called H2testw ( -- by Harald Bögeholz / c't Magazin für Computertechnik , can be be downloaded at the heise dot de download site). The readme is in German, yet the program can measure the write and read speed, too. On my fake 8 GB stick, I only get about 1 to 3 MB/s write speed which is an indication that there is something really weird going on here. the Utility sees the USB stick as 8144 MB in size when empty which is totally impossible, another hint that it was manipulated. Don't forget to delete all test data from the stick when you are done.

No comments:

Search your phone details here