TIL: F3, "Fight Flash Fraud"

[Jas Eckard]

I bought some SD cards off of AliExpress the other day, and, knowing
that the brand names "SanDian" and "Sansumg" were obvious look-alikes
to SanDisk and Samsung, suspected they might be rip-offs. I was going
to see for sure if my 2TB cards were in fact 2TB by crafting my own
`dd` command, when I did a Google search and found out about a project
called F3, "Fight Flash Fraud". It turns out my "2TB" SD cards were
in fact 8GB:

$ sudo f3probe --destructive --time-ops /dev/mmcblk0
F3 probe 8.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

WARNING: Probing normally takes from a few seconds to 15 minutes, but
it can take longer. Please be patient.

Bad news: The device `/dev/mmcblk0' is a counterfeit of type limbo

You can "fix" this device using the following command:
f3fix --last-sec=16292863 /dev/mmcblk0

Device geometry:
*Usable* size: 7.77 GB (16292864 blocks)
Announced size: 1.95 TB (4194304000 blocks)
Module: 2.00 TB (2^41 Bytes)
Approximate cache size: 0.00 Byte (0 blocks), need-reset=no
Physical block size: 512.00 Byte (2^9 Bytes)

Probe time: 366.7ms
Operation: total time / count = avg time
Read: 86.0ms / 2164 = 39us
Write: 279.9ms / 2155 = 129us
Reset: 0us / 0 = 0us

--Jas E
.
..:

[Bill Jacqmein]

"counterfeit of type limbo" - Loved this.

So you can still use them as 8GB with setting the actual last sector?

> --
> You received this message because you are subscribed to the Google Groups "Upstate Carolina Linux Users Group" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to uclug+un...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/uclug/CAC%2BRRjuA%3D5ygSxTqt487uwv2-8TEazCyjJ_znyWaD52N_4gKhQ%40mail.gmail.com.

[Jas Eckard]

I'm not sure. I ran the "f3fix" command it suggested, and now my
system can't seem to detect them.

--Jas
.
..:

> To view this discussion on the web visit https://groups.google.com/d/msgid/uclug/CAMQEVvF%2BcimSwNWjhUsp8dwGCTg%3DvJUhbNOxYB9xcn8Gurpc4g%40mail.gmail.com.

[George Law]

LoL I've got a "2tb" thumb drive I bought last year that I need to try this with 🤣

To view this discussion on the web visit https://groups.google.com/d/msgid/uclug/CAC%2BRRjvyeqeOzTt2NHGy0NoSreRPzv5dWKJORsntocmfs497zw%40mail.gmail.com.

[shay walters]

> I'm not sure. I ran the "f3fix" command it suggested, and now my
> system can't seem to detect them.

Well, I guess it "fixed" them! :-) Yeah, I'd be really wary of
something named a look-alike name like Samdisk etc.

[George Law]

yeah, got one too ;)

$ sudo f3probe --destructive --reset-type=1 --time-ops /dev/sdb

F3 probe 8.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

WARNING: Probing normally takes from a few seconds to 15 minutes, but
         it can take longer. Please be patient.

Bad news: The device `/dev/sdb' is a counterfeit of type limbo

You can "fix" this device using the following command:

f3fix --last-sec=24821759 /dev/sdb

Device geometry:
        *Usable* size: 11.84 GB (24821760 blocks)
       Announced size: 1.91 TB (4095997952 blocks)

               Module: 2.00 TB (2^41 Bytes)

Approximate cache size: 0.00 Byte (0 blocks), need-reset=yes

  Physical block size: 512.00 Byte (2^9 Bytes)

Probe time: 2'28"

 Operation: total time / count = avg time

      Read: 2.62s / 4212 = 623us
     Write: 2'15" / 2164 = 62.6ms
     Reset: 10.04s / 24 = 418.6ms
[glaw@hive TS]$ sudo f3fix --last-sec=24821759 /dev/sdb
F3 fix 8.0

Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

Drive `/dev/sdb' was successfully fixed

after mkfs.ext4 it does at least come back as 11GB

funny thing is that before I reformatted it (and before I got 3probe to run correctly), I had tried f3write and it had said it had written 60+GB to the thumb drive

I had at least what looked like  60 1GB files on the drive

~~~

-rw-r--r--  1 glaw glaw 1073741824 Mar  5 08:52 1.h2w
-rw-r--r--  1 glaw glaw 1073741824 Mar  5 08:57 2.h2w

...

-rw-r--r--  1 glaw glaw 1073741824 Mar  5 11:11 57.h2w
-rw-r--r--  1 glaw glaw 1073741824 Mar  5 11:13 58.h2w
-rw-r--r--  1 glaw glaw 1073741824 Mar  5 11:15 59.h2w
-rw-r--r--  1 glaw glaw 1073741824 Mar  5 11:17 60.h2w
-rw-r--r--  1 glaw glaw  546663936 Mar  5 11:18 61.h2w

~~~

--
You received this message because you are subscribed to the Google Groups "Upstate Carolina Linux Users Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to uclug+un...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/uclug/CAKdjT5K6NQFgni%2BPmsYRrMp-KG46F5ZzqsuUazBF0mKt6qpisQ%40mail.gmail.com.