How to tell if you have a fake sd card

Open the card device directly, and write 0x00 to it up to the capacity on the label. Write 0x55 0xff 0xaa to the first three bytes, and look for any non-0x00 byte up to the capacity on the label. If you find one, the card is either fake or defective. If you find 0x55 0xff 0xaa... definitely fake.

dd if=/dev/zero of=/dev/mmcblkX bs=16M count=...
echo -e -n '\x55\xff\xaa' > /dev/mmcblkX
hexdump /dev/mmcblkX

I believe this is also worth mentionning a replacement for h2testw: f3.

The documentation is at:

  • https://fight-flash-fraud.readthedocs.io/en/stable/

On my system:

$ sudo apt-get install f3

The most basic usage is simply:

$ sudo f3probe --destructive --time-ops /dev/mmcblk0

or

$ sudo f3probe --destructive --time-ops /dev/sdb

depending on how your system see the sdcard reader.

On my system this reports:

F3 probe 6.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

WARNING: Probing normally takes from a few seconds to 15 minutes, but
it can take longer. Please be patient.

Bad news: The device `/dev/sdb' is a counterfeit of type limbo

You can "fix" this device using the following command:
f3fix --last-sec=7860034 /dev/sdb

Device geometry:
*Usable* size: 3.75 GB (7860035 blocks)
Announced size: 15.62 GB (32768000 blocks)
Module: 16.00 GB (2^34 Bytes)
Approximate cache size: 1.00 MB (2048 blocks), need-reset=no
Physical block size: 512.00 Byte (2^9 Bytes)

Probe time: 1'11"
Operation: total time / count = avg time
Read: 336.9ms / 4260 = 79us
Write: 1'10" / 57554 = 1.2ms
Reset: 164.9ms / 1 = 164.9ms

If you cannot use f3probe, you'll have to use the legacy approach (f3write followed by f3read):

$ f3write /media/malat/NEW\ VOLUME
Free space: 15.61 GB
Creating file 1.h2w ... OK!
Creating file 2.h2w ... OK!
Creating file 3.h2w ... OK!
Creating file 4.h2w ... OK!
Creating file 5.h2w ... OK!
Creating file 6.h2w ... OK!
Creating file 7.h2w ... OK!
Creating file 8.h2w ... OK!
Creating file 9.h2w ... OK!
Creating file 10.h2w ... OK!
Creating file 11.h2w ... OK!
Creating file 12.h2w ... OK!
Creating file 13.h2w ... OK!
Creating file 14.h2w ... OK!
Creating file 15.h2w ... OK!
Creating file 16.h2w ... OK!
Free space: 0.00 Byte
Average writing speed: 8.48 MB/s

$ f3read /media/malat/NEW\ VOLUME
                  SECTORS      ok/corrupted/changed/overwritten
Validating file 1.h2w ... 2097152/        0/      0/      0
Validating file 2.h2w ... 2097152/        0/      0/      0
Validating file 3.h2w ... 2097152/        0/      0/      0
Validating file 4.h2w ... 1533687/   563465/      0/      0
Validating file 5.h2w ...       0/  2097152/      0/      0
Validating file 6.h2w ...       0/  2097152/      0/      0
Validating file 7.h2w ...       0/  2097152/      0/      0
Validating file 8.h2w ...       0/  2097152/      0/      0
Validating file 9.h2w ...       0/  2097152/      0/      0
Validating file 10.h2w ...       0/  2097152/      0/      0
Validating file 11.h2w ...       0/  2097152/      0/      0
Validating file 12.h2w ...       0/  2097152/      0/      0
Validating file 13.h2w ...       0/  2097152/      0/      0
Validating file 14.h2w ...       0/  2097152/      0/      0
Validating file 15.h2w ...       0/  2097152/      0/      0
Validating file 16.h2w ...      16/  1273792/      0/      0

  Data OK: 3.73 GB (7825159 sectors)
Data LOST: 11.88 GB (24905929 sectors)
      Corrupted: 11.88 GB (24905929 sectors)
Slightly changed: 0.00 Byte (0 sectors)
    Overwritten: 0.00 Byte (0 sectors)
Average reading speed: 3.20 MB/s

Given that the problem shows up at filesizes of 4GB what file system is in use on the card?

If it is FAT32 the problem you are seeing might be caused by FAT32 having an upper file size limit of 4GB. See http://en.wikipedia.org/wiki/File_Allocation_Table#FAT32 for more information

On Windows you can identify the file system by right clicking on the device in "My Computer" and selecting properties. Look at the "file system" field.


I recently found a program Scanflash - http://www.shikadi.net/scanflash/ which scans a disk under Linux, finds out if its fake and partitions the useable areas. It takes a long time though. (Like a full day on a 128 gig fake flash)