AltraMayor / f3

F3 - Fight Flash Fraud
https://fight-flash-fraud.readthedocs.io/en/stable/
GNU General Public License v3.0
2.52k stars 141 forks source link

f3probe cannot detect scam disk #219

Open Yabgu opened 4 months ago

Yabgu commented 4 months ago

I have tried this tool which I compiled from the master branch, on a scam nvme disk and it runs as below:

root@server:~/f3# ./f3probe --destructive --time-ops /dev/nvme0n1
F3 probe 8.0
Copyright (C) 2010 Digirati Internet LTDA.
This is free software; see the source for copying conditions.

WARNING: Probing normally takes from a few seconds to 15 minutes, but
         it can take longer. Please be patient.

Good news: The device `/dev/nvme0n1' is the real thing

Device geometry:
                 *Usable* size: 3.64 TB (7814037168 blocks)
                Announced size: 3.64 TB (7814037168 blocks)
                        Module: 4.00 TB (2^42 Bytes)
        Approximate cache size: 0.00 Byte (0 blocks), need-reset=no
           Physical block size: 512.00 Byte (2^9 Bytes)

Probe time: 10.87s
 Operation: total time / count = avg time
      Read: 75.5ms / 4822 = 15us
     Write: 6.31s / 4192321 = 1us
     Reset: 1us / 1 = 1us

I know this drive does not have 4TB for sure. How do I know it? Because I tried to use it. Here is how it goes: When I start using this as a disk with Steam, it starts to download files and the first few gigabytes it had normal stat SSD speed like 500 MB/sec and then it switches to 2MB/sec write speed. If you patiently wait for more data to be written, which took me a day, it eventually gets to the point of wiping all your data. I guess they are getting better at scamming and it is now even worse because this disk is useless. Even if you reduce the capacity, eventually it will wipe itself like a time bomb.

If you have any suggestions on detecting this type of disk? I can help testing new detection mechanisms on this disk,

The disk in question looks like this: scam ssd

AltraMayor commented 4 months ago

Hi @Yabgu,

You can use f3write / f3read to check this drive. Since the drive must hold all the data to pass, it cannot escape this test. You can use the parameters --start-at=NUM and --end-at=NUM to instruct f3write to gradually add files.

axet commented 3 months ago

f3probe has to be used with f3write / f3read.