Testing USB drives with F3
How to test USB flash drives for fraud with F3 on Linux
I ordered myself some USB 3 32 GB flash disks from AliExpress for an upcoming NAS project, and wanted to take this opportunity to write-up about a tool that I use for testing these before use.
Even though most electronic devices and components are made and come from Asia, this is actually the first time I've ordered these online through AliExpress.
The reason why I want to test these, is not just because I want to use them for something that needs to be reliable, but also, you can be amazed about how fraudulent the reported capacity and speeds can be, not to mention, is this really a genuine SanDisk product?
This is where F3 comes into play. The name stands for "Fight Flash Fraud".
Let's first plug one of the USB sticks in and see what we can find.
# lsblk | grep sdb
sdb 8:16 1 28,7G 0 disk
└─sdb1 8:17 1 28,7G 0 part /media/carroarmato0/50A2-38D8
# sudo fdisk -uc -l /dev/sdb
Disk /dev/sdb: 28,65 GiB, 30765219840 bytes, 60088320 sectors
Disk model: SanDisk 3.2Gen1
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000
Device Boot Start End Sectors Size Id Type
/dev/sdb1 32 60088319 60088288 28,7G c W95 FAT32 (LBA)
# tree -ahp /media/carroarmato0/50A2-38D8/
/media/carroarmato0/50A2-38D8/
├── [drwxr-xr-x 16K] SanDiskSecureAccess
│ ├── [-rw-r--r-- 353K] DownloadSanDiskSecureAccess_Mac.pdf
│ └── [-rw-r--r-- 2.6M] SanDisk_SecureAccess_QSG.pdf
└── [-rwxr-xr-x 8.2M] SanDiskSecureAccessV3.01_win.exe
1 directory, 3 files
Here we can conclude that there's one partition containing some PDFs and an executable.
The PDFs just contain some installation instructions for PC and Mac on how to use SanDisk's tool for encrypting your data onto the USB stick.
A scan of the .exe file on VirusTotal only returned one match against a heuristic anti-virus scanner, but the reliability of those are very low, so I have no reason to distrust it, other than confirming its useless since I use Linux anyway.
While the box advertises 32 GB of capacity, and we seemingly are seeing only ~28.7 GB, is perfectly normal and has to do with how storage is represented. The manufacturer presents the capacity through the base10 decimal system, while our system calculates in base2, binary.
And appropriately, on the back of the box, the manufacturer makes it clear (in Chinese) that the capacity of 1 GB = 1 billion bytes (1000 MB), instead of 1024 MB. For 1 GB, that's a 73,741,824 bytes difference. So if we do the math right, the actual size of 32 GB is:
32,000,000,000 bytes / (1024*1024*1024) = 29,80 GB
The math checks out!
For the actual testing, we'll install F3. It should be present in most distribution's package manager.
# sudo apt install f3
f3write will fill up the disk with files containing pseudo-random data.
# f3write /media/carroarmato0/50A2-38D8/
F3 write 7.2
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
Free space: 28.63 GB
Creating file 1.h2w ... OK!
Creating file 2.h2w ... OK!
Creating file 3.h2w ... OK!
Creating file 4.h2w ... OK!
Creating file 5.h2w ... OK!
Creating file 6.h2w ... OK!
Creating file 7.h2w ... OK!
Creating file 8.h2w ... OK!
Creating file 9.h2w ... OK!
Creating file 10.h2w ... OK!
Creating file 11.h2w ... OK!
Creating file 12.h2w ... OK!
Creating file 13.h2w ... OK!
Creating file 14.h2w ... OK!
Creating file 15.h2w ... OK!
Creating file 16.h2w ... OK!
Creating file 17.h2w ... OK!
Creating file 18.h2w ... OK!
Creating file 19.h2w ... OK!
Creating file 20.h2w ... OK!
Creating file 21.h2w ... OK!
Creating file 22.h2w ... OK!
Creating file 23.h2w ... OK!
Creating file 24.h2w ... OK!
Creating file 25.h2w ... OK!
Creating file 26.h2w ... OK!
Creating file 27.h2w ... OK!
Creating file 28.h2w ... OK!
Creating file 29.h2w ... OK!
Free space: 0.00 Byte
Average writing speed: 20.82 MB/s
Average writing speed: 20,82 MB/s.
And now for the reading part, using f3read:
# f3read /media/carroarmato0/50A2-38D8/
F3 read 7.2
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
SECTORS ok/corrupted/changed/overwritten
Validating file 1.h2w ... 2097152/ 0/ 0/ 0
Validating file 2.h2w ... 2097152/ 0/ 0/ 0
Validating file 3.h2w ... 2097152/ 0/ 0/ 0
Validating file 4.h2w ... 2097152/ 0/ 0/ 0
Validating file 5.h2w ... 2097152/ 0/ 0/ 0
Validating file 6.h2w ... 2097152/ 0/ 0/ 0
Validating file 7.h2w ... 2097152/ 0/ 0/ 0
Validating file 8.h2w ... 2097152/ 0/ 0/ 0
Validating file 9.h2w ... 2097152/ 0/ 0/ 0
Validating file 10.h2w ... 2097152/ 0/ 0/ 0
Validating file 11.h2w ... 2097152/ 0/ 0/ 0
Validating file 12.h2w ... 2097152/ 0/ 0/ 0
Validating file 13.h2w ... 2097152/ 0/ 0/ 0
Validating file 14.h2w ... 2097152/ 0/ 0/ 0
Validating file 15.h2w ... 2097152/ 0/ 0/ 0
Validating file 16.h2w ... 2097152/ 0/ 0/ 0
Validating file 17.h2w ... 2097152/ 0/ 0/ 0
Validating file 18.h2w ... 2097152/ 0/ 0/ 0
Validating file 19.h2w ... 2097152/ 0/ 0/ 0
Validating file 20.h2w ... 2097152/ 0/ 0/ 0
Validating file 21.h2w ... 2097152/ 0/ 0/ 0
Validating file 22.h2w ... 2097152/ 0/ 0/ 0
Validating file 23.h2w ... 2097152/ 0/ 0/ 0
Validating file 24.h2w ... 2097152/ 0/ 0/ 0
Validating file 25.h2w ... 2097152/ 0/ 0/ 0
Validating file 26.h2w ... 2097152/ 0/ 0/ 0
Validating file 27.h2w ... 2097152/ 0/ 0/ 0
Validating file 28.h2w ... 2097152/ 0/ 0/ 0
Validating file 29.h2w ... 1315840/ 0/ 0/ 0
Data OK: 28.63 GB (60036096 sectors)
Data LOST: 0.00 Byte (0 sectors)
Corrupted: 0.00 Byte (0 sectors)
Slightly changed: 0.00 Byte (0 sectors)
Overwritten: 0.00 Byte (0 sectors)
Average reading speed: 133.61 MB/s
Average reading speed of 133.61 MB/s, a bit slower than the advertised 150 MB/s, but this in an average and depends on multiple factors, so this is quite acceptable.
f3probe will do a quick capacity check, this operation is destructive and will wipe any data that's on it (even though the PDFs and the executable file survived after the operation), so use with caution and only with new flash drives with nothing important on them!
# sudo f3probe --destructive --time-ops /dev/sdb
F3 probe 7.2
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.
WARNING: Probing normally takes from a few seconds to 15 minutes, but
it can take longer. Please be patient.
Good news: The device `/dev/sdb' is the real thing
Device geometry:
*Usable* size: 28.65 GB (60088320 blocks)
Announced size: 28.65 GB (60088320 blocks)
Module: 32.00 GB (2^35 Bytes)
Approximate cache size: 0.00 Byte (0 blocks), need-reset=no
Physical block size: 512.00 Byte (2^9 Bytes)
Probe time: 1'27"
Operation: total time / count = avg time
Read: 528.9ms / 4815 = 109us
Write: 1'25" / 4192321 = 20us
Reset: 0us / 1 = 0us
The tool happily reports that the device is genuine and presents the storage the way it is advertised. Looks like I got myself a genuine trustworthy pair (well, at least one of them) SanDisk USB flash drives :)
If you do encounter a negative report from the tool, you can lookup additional resource on what you can do from the website of F3 to have the device advertise its real size to the OS: https://fight-flash-fraud.readthedocs.io/en/latest/introduction.html#correcting-capacity-to-actual-size-with-f3fix.
Or, you can use this information to start a fraud claim against the seller.