AltraMayor / f3

F3 - Fight Flash Fraud
https://fight-flash-fraud.readthedocs.io/en/stable/
GNU General Public License v3.0
2.56k stars 144 forks source link

f3probe cannot detect scam disk #219

Open Yabgu opened 6 months ago

Yabgu commented 6 months ago

I have tried this tool which I compiled from the master branch, on a scam nvme disk and it runs as below:

root@server:~/f3# ./f3probe --destructive --time-ops /dev/nvme0n1
F3 probe 8.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

WARNING: Probing normally takes from a few seconds to 15 minutes, but
         it can take longer. Please be patient.

Good news: The device `/dev/nvme0n1' is the real thing

Device geometry:
                 *Usable* size: 3.64 TB (7814037168 blocks)
                Announced size: 3.64 TB (7814037168 blocks)
                        Module: 4.00 TB (2^42 Bytes)
        Approximate cache size: 0.00 Byte (0 blocks), need-reset=no
           Physical block size: 512.00 Byte (2^9 Bytes)

Probe time: 10.87s
 Operation: total time / count = avg time
      Read: 75.5ms / 4822 = 15us
     Write: 6.31s / 4192321 = 1us
     Reset: 1us / 1 = 1us

I know this drive does not have 4TB for sure. How do I know it? Because I tried to use it. Here is how it goes: When I start using this as a disk with Steam, it starts to download files and the first few gigabytes it had normal stat SSD speed like 500 MB/sec and then it switches to 2MB/sec write speed. If you patiently wait for more data to be written, which took me a day, it eventually gets to the point of wiping all your data. I guess they are getting better at scamming and it is now even worse because this disk is useless. Even if you reduce the capacity, eventually it will wipe itself like a time bomb.

If you have any suggestions on detecting this type of disk? I can help testing new detection mechanisms on this disk,

The disk in question looks like this: scam ssd

AltraMayor commented 6 months ago

Hi @Yabgu,

You can use f3write / f3read to check this drive. Since the drive must hold all the data to pass, it cannot escape this test. You can use the parameters --start-at=NUM and --end-at=NUM to instruct f3write to gradually add files.

axet commented 4 months ago

f3probe has to be used with f3write / f3read.

Pheromon commented 1 week ago

I've a similar problem with another fake USB key that is advertised as 2TB and detected as 1TB usable when in reality the usb key size is around 7GB (tested with f3write).

This is the output:

# f3probe --destructive --time-ops /dev/sda
F3 probe 8.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

WARNING: Probing normally takes from a few seconds to 15 minutes, but
it can take longer. Please be patient.

Bad news: The device `/dev/sda' is a counterfeit of type limbo

You can "fix" this device using the following command:
f3fix --last-sec=2147483647 /dev/sda

Device geometry:
*Usable* size: 1.00 TB (2147483648 blocks)
Announced size: 1.90 TB (4075520000 blocks)
Module: 2.00 TB (2^41 Bytes)
Approximate cache size: 1.00 MB (2048 blocks), need-reset=no
Physical block size: 512.00 Byte (2^9 Bytes)

Probe time: 3.76s
Operation: total time / count = avg time
Read: 256.6ms / 4213 = 60us
Write: 3.50s / 22706 = 154us
Reset: 0us / 1 = 0us

Is there a way so I can give you some more details in order for F3 to detect the real usable size?