Estimated reading time: 4 minutes

Making purchases online is very convenient, but it also exposes us to the risk of a lot of hassle. One above all is the possibility of getting screwed. It matters little whether the seller is a private individual or a large chain: on technological products (unless the brand is explicitly stated) it is necessary to check the actual functionality upon arrival.

This is the case with USB sticks. Some time ago I wanted to have fun with an item for sale on the most famous online store. The item for sale is a very small USB stick, Sold with a ring to attach to the keys.

• Declared dimensions: 2TB
• Cost: from i 5 e i 10 Euro

Obviously I purchased the item well aware of the scam, but I wanted to have some fun’ and report the fraudulent sale to the store.

Spoiler: the store has “sanctioned” the seller by suspending or closing the account. A few days later I found the item on sale on the same store through other accounts.

The moment the flash drive arrived home I immediately wanted to test its actual size. I insert the flash drive into the port and read what the PC detects.

~ $ lsblk
NAME                 MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
sda                    8:0    0 465,8G  0 disk 
├─sda1                 8:1    0   489M  0 part /boot
└─sda2                 8:2    0 465,3G  0 part 
  ├─SolusSystem-Swap 253:0    0   3,7G  0 lvm  [SWAP]
  └─SolusSystem-Root 253:1    0 461,6G  0 lvm  /
sdb                    8:16   1     0B  0 disk 
sdc                    8:32   1   1,9T  0 disk 
└─sdc1                 8:33   1   1,9T  0 part /run/media/joe/76E8-CACF
sr0                   11:0    1  1024M  0 rom  
zram0                252:0    0   3,8G  0 disk [SWAP]

Be Gnome's file manager, be lsblk They give me a newly mounted mass memory of about 2TB, compatible with a memory of that actual size. The thing a little’ my surprise… How can such a small key have so much capacity??

I then decide to to install f3, which for those who don't know is a small command line software designed specifically to test fraudulent USB sticks (f3 stands for “Fight Flash Fraud“). It is found in all repositories and installing directly from sources is simple and painless.

The use of f3 is very simple: It consists of two utilities that must be launched one after the other.

Let's launch first f3write to write files of fixed size into memory. Then we will launch f3read to read the actual contents of the flash drive. If there are errors it means that the key declares a false capacity.

~ $ f3write /run/media/joe/76E8-CACF/
F3 write 8.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

Free space: 1.91 TB
Creating file 1.h2w ... 0.02% -- 6.11 MB/s -- 94:30:14

This operation can be very time consuming, especially for sticks that declare speed from USB3 (5 Gbit/s), while instead they settle between the 5 e i 10 MB/s… and I don't have 94 hours to wait for the writing process to complete.

F3 also includes a faster variant. In this case you need to dismantle the mass memory and launch f3probe as root or superuser pointing to the device and no longer to the mountpoint. This second approach is quicker, but the result can still come later 15 minutes or more. Especially in the case of particularly slow memories (as in my case) you need to arm yourself with patience, or find something else to do in the meantime.

~ $ sudo f3probe --destructive --time-ops /dev/sdc
F3 probe 8.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

WARNING: Probing normally takes from a few seconds to 15 minutes, but
         it can take longer. Please be patient.

Bad news: The device `/dev/sdc' is a counterfeit of type limbo

You can "fix" this device using the following command:
f3fix --last-sec=16082303 /dev/sdc

Device geometry:
	         *Usable* size: 7.67 GB (16082304 blocks)
	        Announced size: 1.91 TB (4096000000 blocks)
	                Module: 2.00 TB (2^41 Bytes)
	Approximate cache size: 511.00 MB (1046528 blocks), need-reset=no
	   Physical block size: 512.00 Byte (2^9 Bytes)

Probe time: 16'48"
 Operation: total time / count = avg time
      Read: 47.87s / 2097717 = 22us
     Write: 15'58" / 7327949 = 130us
     Reset: 1us / 2 = 0us

And this is the result after about 15 minutes. The summary presented shows us the actual capacity of the flash drive: 7.67 GB, when it was supposed to be 1.91 TB. The cache is 511 MB and the blocks are from 512 Byte.

Typically when we copy data onto these sticks the data is written up to the actual capacity (in this case 7.67 GB), then they are overwritten. Once we have finished copying the data it will seem that everything has been saved correctly, but when we go to open a file we will see an irreversible error and the data (the document, the photo or something) will be gone forever.

In the example above the first screen shows a directory copied when the physical limit of the stick is reached. The files are still visible, but the content is not. The second screen shows a directory that has not yet been overwritten and the files still exist.

There is also a suggestion of f3probe to correct the capacity of the key. In practice it suggests creating a partition with a total size of 7.67 GB (last useful sector 16082303) and leave the next space unpartitioned. In this way, by inserting the stick into a PC we will only see the 7.67 GB of space and not the crap that follows.

By launching f3fix the stick will be restored to the correct size.

~ $ lsblk
NAME                 MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
sda                    8:0    0 465,8G  0 disk 
├─sda1                 8:1    0   489M  0 part /boot
└─sda2                 8:2    0 465,3G  0 part 
  ├─SolusSystem-Swap 253:0    0   3,7G  0 lvm  [SWAP]
  └─SolusSystem-Root 253:1    0 461,6G  0 lvm  /
sdb                    8:16   1     0B  0 disk 
sdc                    8:32   1   1,9T  0 disk 
└─sdc1                 8:33   1   7,7G  0 part 
sr0                   11:0    1  1024M  0 rom  
zram0                252:0    0   3,8G  0 disk [SWAP]