05/7/2017 – 128GB MicroSD fake capacity
Today, CDR has been working on a MicroSD memory card which had a reported capacity of 128GB. The memory card had been purchased from Amazon Market Place. It had been used by the customer to record video from an underwater Go Pro camera showing diving around a reef. The FAT filesystem was corrupt and the owner could not read the files from the device.
Result:
The device appeared to image normally on PC3000 reporting no read errors. The file allocation table (FAT) rebuilt well to show the folder and file name structure. The data was extracted in the form of recognisable files. However, a proportion of the video file stored on the memory card would not play back and were corrupt.
Inspection of the data in a hexadecimal editor showed that after 8GB of normal data the memory card was filled with “FF” pattern. Tests were conducted to assess the write capabilities to the device. When a test pattern was written to the memory card it appeared normally, until the memory card was powered off, and then on. Once the area of the memory card was read again the new data which had been written no longer appeared.
-
- A “TEST” pattern is written to the memory card and saved
-
- When the device is powered off, and on, the TEST pattern no longer appears.
Counterfeit Memory Card
The tests confirmed that this was not actually a 128GB memory card. It was an 8GB memory card, which had been altered deliberately to appear as if it was a 128GB device. This form of counterfeiting is very common, particularly so on devices sold on Amazon Market Place and eBay. If you find that you have purchased a counterfeit memory card or memory stick from either Amazon or eBay you should report it to the website’s administration.
It was possible to make a partial recovery of data from the memory card, however, due to the nature of the counterfeiting process it was impossible to make a full recovery.