How to spot a fake USB drive or SD card

The short version

A counterfeit flash drive has its controller reprogrammed to report a capacity far larger than the memory chip inside. Your computer believes it, because reported capacity is the one number the drive itself decides. Everything looks fine until you write past the real size — at which point the drive silently wraps around and overwrites your earliest files.

You usually find out months later, when a photo you saved in spring won't open. By then the original is long gone.

How the fake-capacity scam actually works

Every USB stick and SD card contains two things: flash memory, and a controller chip that manages it. When you plug it in, your operating system asks the controller how much storage there is. The controller answers. Your OS has no independent way to check.

That's the whole vulnerability. Counterfeiters buy cheap, small, often factory-reject flash — 8GB, 16GB, sometimes less — and reflash the controller's firmware so it answers "1TB" instead. The drive is otherwise a working drive. It formats normally. It shows the right size in Finder and File Explorer. It copies your first few gigabytes at plausible speed.

Then you pass the real capacity, and one of two things happens depending on how the counterfeiter configured it:

• Wraparound. The controller loops back to the start and writes over data you stored earlier. The file table still lists everything, so the drive looks full of files. Most of them are now corrupt.
• Silent discard. The drive accepts the write, reports success, and throws the data away. Files appear to copy fine and come back as zeros.

Both are worse than a drive that simply fails, because both hide the failure from you at exactly the moment you'd want to know.

Warning signs before you even test

• The price is impossible. Real flash has a floor price per gigabyte. If a 2TB stick costs less than a name-brand 64GB one, the capacity is fiction.
• The brand is a jumble of letters. Marketplace listings with invented brand names and enormous capacities are the classic pattern.
• The capacity is implausible for the format. Be sceptical of microSD cards advertised well beyond current mainstream retail capacities at a fraction of the price.
• Reviews mention corruption. Sort by lowest rating and look for "files disappeared" or "photos are corrupt" — that's this exact failure being described by someone who didn't know the term for it.

Why checking the size in Finder or Disk Utility proves nothing

This is the most common mistake, and it's worth being blunt about: every tool that reports a drive's capacity is just repeating what the drive claimed. Disk Utility, File Explorer, System Information, diskutil list — all of them ask the controller and print the answer.

A fake drive passes every one of those checks perfectly, because lying to them is the entire product. Verified capacity is the only number that means anything, and verifying requires writing real data and reading it back.

How to actually test it (free, a few minutes)

Cinder's free Drive Integrity & Capacity Test does this, needs no licence, and runs on macOS and Windows:

• Fast Boundary Probe writes markers at doubling offsets and binary-searches for the wraparound — it can flag a fake multi-terabyte claim in seconds.
• Full Sequential Verify writes and re-checks markers across the entire claimed capacity for maximum certainty, the same core approach as the well-known h2testw tool.

It writes one visible, clearly-named test file you can watch in Finder, and deletes it when done. If the drive is faking its size, the test catches the moment earlier data gets overwritten and reports the real usable capacity.

Prefer open-source command-line tools? F3 does the same job well on macOS and Linux (brew install f3), and h2testw is the Windows original. We compare all of them, including the ones we don't make, on our h2testw-for-Mac page.

How long should the test take?

A full verify is bounded by write speed, not by cleverness. A slow USB 2.0 stick might manage 8 MB/s, so a genuine 256GB drive takes several hours — that's normal and it means the drive is real enough to be writing properly. The fast probe usually settles the question in under a minute, which is why it's worth starting there and only running the full verify if you need certainty.

One useful tell: a fake drive often gets dramatically slower past its real capacity, because the controller is thrashing. If throughput collapses at the 30GB mark on a "1TB" drive, you already have your answer.

What to do if a drive fails

Stop using it. Not for backups, not for a Raspberry Pi, not "just for unimportant files." A drive that lies about capacity will lie again.

You cannot fix it. Reformatting won't help — the lie is in firmware, and formatting only rewrites structures on top of it. Tools that "restore" a fake drive to its real capacity exist, but they leave you with an unbranded 8GB stick of unknown-quality flash. Not worth the risk for anything you care about.

Get your money back. Contact the seller, then escalate to the marketplace, then to your card issuer as a chargeback. Attach the test result. Misrepresenting storage capacity is straightforward fraud, and marketplaces generally act quickly when you present evidence rather than a complaint.

If it already ate your files

Some of the overwritten data may still be recoverable, depending on how much was written past the boundary and what landed on top. Stop writing to the drive immediately, then scan it and preview what's left for free. You'll see exactly which files survived before deciding whether to pay for anything.

Recover to a different drive, obviously — and not to another one you haven't tested.

The habit worth building

Test every flash drive and memory card the day it arrives, before it holds anything. It costs you one unattended evening per drive and it converts an invisible risk into a known quantity. For camera cards especially — where the failure surfaces after a shoot you can't repeat — that's the cheapest insurance available.

← Back to all articles