Fake SanDisk drives may have hokey looking info

  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in please checkout the “Tips & Tricks” page for some very handy tips!

    /Steve.
  • BootAble – FreeDOS boot testing freeware

    To obtain direct, low-level access to a system's mass storage drives, SpinRite runs under a GRC-customized version of FreeDOS which has been modified to add compatibility with all file systems. In order to run SpinRite it must first be possible to boot FreeDOS.

    GRC's “BootAble” freeware allows anyone to easily create BIOS-bootable media in order to workout and confirm the details of getting a machine to boot FreeDOS through a BIOS. Once the means of doing that has been determined, the media created by SpinRite can be booted and run in the same way.

    The participants here, who have taken the time to share their knowledge and experience, their successes and some frustrations with booting their computers into FreeDOS, have created a valuable knowledgebase which will benefit everyone who follows.

    You may click on the image to the right to obtain your own copy of BootAble. Then use the knowledge and experience documented here to boot your computer(s) into FreeDOS. And please do not hesitate to ask questions – nowhere else can better answers be found.

    (You may permanently close this reminder with the 'X' in the upper right.)

rd369151

Member
Jan 11, 2025
16
0
Yesterday I found that one of my SanDisk thumb drives was fake.
(A SanDisk 256GB Ultra USB 3.0 Flash Drive, that I bought from Amazon in Sep 2022, and the page is still up.)

Besides the report data details that show the faked capacity, the information details have hokey looking "hub or drive vendor", "hub or drive product", and "serial number" entries compared to real SanDisk products.

Upon closer inspection, some cosmetic detail difference are also detectable.

(I've also been stung by fake electric toothbrush heads, and other products from Amazon.)

I realize that the funny looking information details could be made to look better by the counterfeiters, but for some, that may also be a clue that the drive is fake.

(I've got some TF cards I need to test now.)
 
The first ValiDrive test I ran on that flash drive showed that it appeared to be fake, having only 32 GB of the supposed 250 GB it should have.
And doing a checksum compare of its contents vs. the files on my hard disk found that none of the 180 GB of the big files copied matched.
So the purpose of the copy operation failled. And that something is off with the drive.

But, I tried some other similar utlities to have some corroboration, with many of them not being useful, or also fooled, and with one that that left with drive with Windows saying the drive needed to be formatted, but I ran ValiDrive on it, and found it had 143 GB (out of 250 GB) capacity.
So I then let it have a quick format.
Then, running ValiDrive on it again, found that it now has the full 250 GB capacity available, as if nothing is wrong with it.

Looking around some more, I found yet another utility that may really test the drive's real capacity, but it may take 12 hours to run.

Here are the three reports:

1st rpt.png


2nd rpt.png

3rd rpt.png

My question is, if the drive is truly fake, which I believe it is, why a simple fast format can make it seem good to ValiDrive?
Is a simple format is all it takes, why don't the counterfeit product sellers do that one simple step?
Other comments here from Steve indicate that he will want to make ValiDrive 2.0 more reliable.
Is the above the type of trick that it might catch?
 
Last edited:
Yesterday, in testing other detection tools, I found that "Capacity Tester" after running for half an hour, declared my drive apparently genuine.
So I tried a few more, that werent usable or helpful then found "MediaTester" that "is similar to h2testw" but improved in some ways.
That ran overnight (the 12 hours I mentioned) and declared my drive has "PASSED" the test.
I realized that some of the options might have undermined the tests, so unchecked the "quick" option, and re-started the test.

However, this time I'm getting the checksums (BLAKE3) of every ten (10) of the 1 GB files (1,073,741,824 random bytes) after they are written, so that after the 233 files are written, I can compare the before and after checksums to see what really happened.
 
Last edited:
My re-running of "MediaTester" with the Quick options unchecked, after ten (10) hours of first writing files, then checking them, still got a PASSED result.
It regards my fake 256 GB flash drive as having its full capacity, due to the native Windows quick formatting I had to give it.
If the maker had simply formatted it before packaging, it would have behaved just like a real 256 GB drive.
My 180 GB copy operation would have worked, and if I had run ValiDrive on it, the numbers part of the report would show it had its full capacity.
I'm going to double-check its work with my own saved checksums while the program was running, but that will be tomorrow.
I'll post a screen shot of the MediaTest result screen, and two poor cellphone pictures of the drive itself, which don't really convey how different it looks compared to my other, real, SanDisk drives.

MediaTester, with Quick tests disabled, still reports PASSED on my fake 256, 01-15-25.png


RDTD18, fake 256, top view, cropped.jpg


RDTD18, fake 256, bottom view, cropped.jpg
 
Today I confirmed that MediaTester truly was writing 1 GB binary files of random bytes, until the drive was full, then confirming that they were all identical.
The dev doesn't explain in the user documentation which random generation method nor what checksum algorithm was used to do this task, but an interested party could examine the source code to find this out.

So, this drive has the specified capacity it was sold as, and is therefore just a regular counterfeit item on Amazon, and not the target of what ValiDrive is meant for. But ValiDrive is very useful for giving a heads up for further testing.
 
  • Like
Reactions: CSPea
As for other utilities, the so-called "ChipGenius" that is on many of the lists shows less information about this drive than Nirsoft's USBDeview.
Note that you may need to use the utility to download the latest "usb.ids" file for the most up to date list of names for the VendorID and ProductID columns.
 
  • Dislike
Reactions: Alice