Nandinium's Blog

Fake Flash memory investigator

Let me tell you all a story!!

with 15 comments

It goes like this… Once upon a time.. Nah never mind, you’ve probably heard this one before.

Let me give you all a few facts…. Flash memory chips, USB memory sticks, MP3 players etc!
It has been written from research by those FAR LONGER in the game than I, that 90-95% of all these items are either fake capacity or poor performing counterfeits made to look like the products of such leaders in the technology as Kingston, SanDisk, Transcend.

I am going to present here just one example of a fake Kingston DT200 look-alike.  This model has only been out 6 months, comes in 3 sizes  32GB, 64GB & 128GB, each variety  has a different colour inner part,  so the version is easily recognisable.  It didn’t take the counterfeiters long to come up with their version of the housing,  which to the untrained eye is identical to the real one,  the difference is only noticeable once you pop the lid off the casing,  then you see not a nice large printed circuit board with all the right microchips and bits,  but a tiny and rather tatty looking printed board,  roughly finished off,  crammed up into one end of the case.

 

Kingston DT200 (Fake) Top View

Turning the device over reveals the removeable cover

 

Kingston DT200 (Fake) Back View

Removing the cover plate,  reveals the inner workings

 

Kingston DT200 (Fake) Inside view

NOTE all the spare “Real Estate” in the box,  and the bottom view of the printed board with the vital FLASH memory chip.

Kingston DT200 (Fake) Flash Chip

All the evidence that would point to the actual capacity of the flash chip has conveniently been removed by a process of scouring,  normally the surface of this chip would be smooth and shiny with the makers part number containing the actual capacity in megabits.

On test this fake USB stick returned only 500 Kbytes of real capacity (1/2 of 1MB),  the remaining of the stated 32GB was returned as corrupted and overwritten,  meaning that test program (H2testw) had tried to write it’s unique pattern of data over and over into the same small area of real memory.

Another piece of damning evidence observable during the test is the slow speed at which the test program was able to write to the fake device,  about 2 mbytes/second the makers of the genuine article quote write speeds of 15-20 m bytes/second and a read speed in excess of 20 mbytes/second,  so with this fake you not only didn’t get the capacity you paid for,  you also didn’t get the speed you expected…

Report from H2testw v1.4 after freshly formatting the FAKE USB drive

(Test limited to 1000mB to save time)

Warning: Only 1000 of 32484 MByte tested.
The media is likely to be defective.
535.5 KByte OK (1071 sectors)
999.4 MByte DATA LOST (2046929 sectors)
Details:518.3 MByte overwritten (1061580 sectors)
58.5 KByte slightly changed (< 8 bit/sector, 117 sectors)
481.0 MByte corrupted (985232 sectors)
594 KByte aliased memory (1188 sectors)
First error at offset: 0×0000000000000000
Expected: 0×0000000000000000
Found: 0x000000003e700200
H2testw version 1.3
Writing speed: 2.07 MByte/s
Reading speed: 3.87 MByte/s
H2testw v1.4

From this figure of 535 KBytes I must conclude the real capacity of the FLASH chip was probably 512 KBytes,  so most likely a 4 mbit capacity chip (Bits=8 times Bytes)

For a general view of all Kingston Flash products, so you may recognise them

go to KINGSTON

To follow the day-to-day reports of suspect flash sellers on eBay visit FIGHTFLASHFRAUD

and for details of past and present proven fraudulent sellers SOSFAKEFLASH

Advertisement

Written by nandinium

December 5, 2009 at 11:59 pm

15 Responses

Subscribe to comments with RSS.

  1. Very interesting, haven’t had a chance to examine one of these myself but your findings so far are very much what I would expect for the fakes coming out of China.

    Kingston are driven mad by all the counterfeiting of their products.

    Anyone that is not sure WHAT the Kingston products should look like
    can visit KINGSTON

    fightflashfraud

    December 6, 2009 at 3:02 pm

  2. Kingston is not doing much now about all the counterfeits being sold on ebay. At one time we at fightflashfraud held their hands and sent them lists of the counterfeit Kingston flash drives listed on ebay.

    Since we stopped doing this they have not been doing much about it. It seems that no one but victims who bought fakes is doing anything much about all the fake flash memory on ebay and the Internet generally.

    Who is really doing anything about the plague of flash memory devices that corrupt files?

    Not ebay, not paypal, not Kingston, not Sony, Not Corsair, not Transcend, not any of the companies who should be doing something.

    It is all up to us as victims to alert others. If you bought a flash memory item (memory card, USB flash drive or MP player) that corrupted files – warn everyone you know about the problem and tell them about h2testw.

    Anyone who uses flash memory of any sort should have this program.

    If you have a blog or a website put a warning about this issue on it. A link to the fightflash blog on wordpress would be appreciated too; and should help victims find the help they need.

    fightflashfraud

    February 1, 2010 at 4:38 pm

  3. Hi Nandinium! :-)
    Just wanted to say “Good on ye” for posting the eBay auction warning people about the amount of fake USB media going on there! I was already aware of the problem myself long ago, but I would imagine that the majority of eBay users wouldn’t know the difference between the genuine article and a fake…And it’s great to see someone taking the time out to warn the unwary! :-)

    As it happens, I recently bought a couple of cheap MP3 players that *looked* like iPods when I first took them out of the box, but later comparison with a friends genuine iPod proved them to be cheap fakes. I’ve also got some other “cheap” eBay media that I will run H2TestW over before I use it. :-)
    (On the bright side though, I was happy that my “iPods” were fakes. I don’t like a lot of Apple’s products you see! :-D )

    Anyhow…Just to point out a possible error in your article above:
    One of the H2 lines shows “535.5 K-BYTE OK (1071 sectors)” which suggests to my eye a genuine capacity of 530 *Kilobytes* (Half a meg) as opposed to the 500MB that you’ve reported. A sector calculation (Capacity = SectorLength * SectorCount) seems to affirm this, assuming that FAT formatted pen drives still use the same 512-byte sector size as traditional floppy media.
    Of course, that’s assuming I’m reading the output right. (I’ve not used H2 myself yet. :-)

    As a final question, given that ye seem to be well connected to official anti-counterfeiting groups; I’ve managed to find some good uses for the low quality NAND flash that counterfeit drives tend to contain, and am still happy to make use of it. However, are there legitimate ways to obtain such cheap flash memory in volume *without* having to buy counterfeit drives on eBay and hacking them to ensure they report the genuine capacity correctly?

    Anyhow…Thanks for the excellent article, which I may cross-post over to my own weblog network if ye are happy to give permision for it! :-)
    +++ DieselDragon +++

    DieselDragon

    February 6, 2010 at 9:27 pm

    • You know I looked at that Mbytes a few times and though it didn’t seem right, in the end the suspected maximum capacity of the chip of 4 MBITS was correct, as was the calculation. Thanks for the 2nd pair of eyes, bludner corrected now.

      Certainly cross post it as long as a credit and original link are in the posting somewhere, that is the accepted protocol I believe.

      RE the availability of cheap small flash, there are from time to time sellers dumping out real 512k and suchlike, I’ve noticed they either do not sell, or go at silly prices, seems that when it comes to flash, size IS important! Another reason these fraudsters are getting away with the size scam, the world is full of gullible, easily influenced and non-knowing buyers, all after the largest item at the lowest price, a recipe for pain and disaster.

      You could try some feedback watching, see who is buying these fakes, and from whom, and when you see comments about “refunded” contact the seller, see if they want to cut their losses and let you have their fakes cheap. Some even sell them off as “Faulty” which is a blatant lie of course.

      The item in the picture above is here, but for the moment I do not wish to part with it while the investigation is on-going.

      ** Nandinium **

      nandinium

      February 7, 2010 at 12:09 am

      • [Ahh...The post truncation was due to me not encoding a greater-than symbol properly, leading to the rest of the post being hidden as HTML source. :-S
        Please accept my apologies for this second repost - I would edit/delete my own posts above if I could, but I can't find an option for it. WP *really* needs to add a [Preview] button to the comments system, too!]

        Ay up Nandinium! :-)
        Just thought I’d post a quick update whilst I was checking in on my weblog. (I havn’t been online for weeks! :-O )

        Anyway: A bit of playing around in H2TestW with the fake iPods that I bought on eBay a while ago verified my suspicions that they had hacked flash in them – Insted of their *reported* 16Gb capacity, they actually had a true capacity of only 2Gb. (Annoyingly enough, the counterfeiters have “Shaved” the ID codes off of the flash chip, so I couldn’t double-check by looking it up – I’ve had to go on H2Test’s output.)

        There is a brighter side to the story though:
        After a couple of days poking and prodding at these MP3 players with a screwdriver and an old Ubuntu live CD, I found that one way to make hacked drives usable again is to simply repartition them to their true capacity, making sure that the new partition is physically (I.E: Start LBA <=64) at the start of the drive. This’ll not fix the bad size reporting, but it should at least restrict write operations to areas where real flash exists! :-)

        To my knowlege; Windows won’t allow users to create partitions on removable drives, although it’ll happily read flash drives with more than one partition on them. However, GPartEd (The GNOME Partition Editor for Linux, available on Ubuntu and possibly other live CDs) will happily re-partition any flash disk without fuss, and seems to do a fairly good job at it. :-)

        Sadly, I’m very very busy nowadays (Hence the late reply)…But if I get the chance to do so, I’ll try to get an understandable tutorial for doing this written up and posted to my weblog. :-)

        Farewell for now, and keep up the excellent work on the eBay front! >:-)
        +++ DieselDragon +++

        DieselDragon

        March 5, 2010 at 1:11 am

  4. For more views about fakes, description of counterfeit USB media, and why it’s a bad thing. Visit DieselDragon

  5. [My last post was truncated, probabally because my PC is being iffy tonight. Please accept my apologies for this repost. :-]

    Ay up Nandinium! :-)
    Just thought I’d post a quick update whilst I was checking in on my weblog. (I havn’t been online for weeks! :-O )

    Anyway: A bit of playing around in H2TestW with the fake iPods that I bought on eBay a while ago verified my suspicions that they had hacked flash in them – Insted of their *reported* 16Gb capacity, they actually had a true capacity of only 2Gb. (Annoyingly enough, the counterfeiters have “Shaved” the ID codes off of the flash chip, so I couldn’t double-check by looking it up – I’ve had to go on H2Test’s output.)

    There is a brighter side to the story though:
    After a couple of days poking and prodding at these MP3 players with a screwdriver and an old Ubuntu live CD, I found that one way to make hacked drives usable again is to simply repartition them to their true capacity, making sure that the new partition is physically (I.E: Start LBA :-)
    +++ DieselDragon +++

    DieselDragon

    March 5, 2010 at 1:06 am

    • OK DieselDragon I’ve deleted the truncated post, though it looked OK here, probably only on your local echo.

      The “Shaved off” ID codes is a familiar feature, check out the last picture in my posting about the fake Kingston flash.

      Any tutorial you can write well be welcome I know, as regards your description of my blog as “Laymens view” I have always found in my many writings over the last 3 decades, to adopt the simplistic view gets more readers, and keeps more readers, there is a certain deficit in attention span when the writings get too involved with technicalities.

      Like many technicians, well trained in facts, figures and methods, few make good teachers, with the ability to SLOW down to the pace of the least accomplished pupil and still keep on the theme. I fit well in this category, and with no “Class of pupils” out front to send feedback, one has to pace things at what you expect to be the lowest standard.
      **Nandinium**

      nandinium

      March 5, 2010 at 12:18 pm

  6. impossible to format my key USB 1288GB
    and impossible to do the programs

    liensavanh

    May 25, 2010 at 4:50 pm

    • Sadly my friend that is usually the case with these fakes, I think all you can do is accept the loss and be wiser next time.
      I know that is not very helpful, but quite honestly, although it is possible to recover some fakes to their REAL size it is a
      complex procedure, and in the end the quality of the memory chip is often so poor that it is not worth the effort.

      nandinium

      May 25, 2010 at 9:39 pm

  7. [...] I’ve always been cautious about flash memory ever since I got caught with a fake Kingston 32GB described HERE [...]

  8. those generic mp3 players that are made in china are really cheap but i still prefer to use my ipod ;~;

    French Women

    November 17, 2010 at 8:24 pm

  9. Thanks because of this! I’ve been searching all above the web for that facts.

    ip camera

    December 2, 2010 at 9:47 pm

  10. the information on this submit is really a single of the very best substance that I’ve actually appear throughout. I adore your submit, I will appear back again to examine for new posts.

    網路行銷

    December 6, 2010 at 7:29 pm

  11. Nice post and very well written. Thanks for this!

    Crazyupload

    December 24, 2010 at 4:50 pm


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.