Fake USB Tester

Detect false USB capacity in seconds, find the last reliably usable sector, verify only that range in depth, and turn it into a practical partition.

Windows release pendingHow it works
Version 1.0 complete and validated · desktop release package not yet published on sothis.dev
Windows storage utility

Find the real capacity before spending hours testing the fake one

Counterfeit or misprogrammed USB storage can report a capacity far larger than the flash memory physically present. Traditional full-drive testers eventually expose the problem, but they spend hours writing through an address range that can never be reliable.

Fake USB Tester separates the two questions. First it narrows down the real usable boundary, typically in seconds. Only then does it run a thorough write and read-back verification, and only inside the range that looks genuinely usable.

Why this tool exists

Have you ever bought a high-capacity USB drive that looked perfectly normal — until files started disappearing?

Counterfeit or misprogrammed flash storage can advertise hundreds of gigabytes or even terabytes while containing only a small fraction of that capacity. Windows may format the device normally and early file copies may appear successful. The failure often becomes visible only after writes cross the real flash boundary, when older data can be overwritten, aliased or silently lost.

Do you want to spend hours or days testing a capacity that may not even exist?

Fake USB Tester finds the likely real boundary first, then deeply verifies only the storage worth keeping. After verification, it can create an honestly sized exFAT partition below that boundary so the fake address range is no longer used.

Find fake capacity earlyDiscover the problem before important data is trusted to storage addresses that are not really there.
Test smarter, not longerSearch for the usable boundary first instead of deeply testing an enormous fake address space.
Keep what is realTurn the verified physical capacity into a practical partition rather than discarding the entire device.
Destructive test: capacity verification writes test data directly to raw sectors of the selected device. Existing data and partitions will be destroyed. Use it only on media whose contents can be erased.

Two-stage verification

1

Quick Test

Sample strategic locations across the reported capacity, then binary-search the transition between reliable and unreliable storage instead of sequentially writing the entire advertised size.

2

Deep Test

Run H2testw-style sequential verification across the detected usable area only, writing the whole region before reading any of it back.

3

Safe partition

Create an exFAT partition sized to stay inside the verified region, with a guard zone below the boundary, so Windows never sees the fake address range again.

Why a write followed by a read is not enough

The obvious test — write a pattern to a high sector, read it back, compare — misses the most common counterfeit behaviour. When a controller folds logical address S onto physical address S modulo the real capacity, the write and the read follow the same wrong mapping and agree perfectly. The drive passes, and the fake capacity goes undetected.

Fake USB Tester borrows the single property that makes a full-drive test trustworthy: write every location before reading any of them. Applied to a sparse sample spread across the reported capacity, it exposes address folding at a cost of a few hundred sector operations rather than a full pass over the device. Test patterns carry their own logical address, so when a sector returns another sector's data the log names both.

Verified against simulation: the engine is tested against a simulated device that can reproduce each known counterfeit behaviour — rejected writes, wrapped addresses, aliased address windows, silently discarded writes, and data that survives an immediate read but not a later one. All are detected without hardware present.

Quick Test

  • Works against the raw physical device, not filesystem-reported capacity
  • Test patterns encode their own logical address to expose remapping
  • Sparse write-all-then-read-all sampling detects address wrapping and aliasing
  • Binary-search refinement locates the boundary in logarithmic time
  • Repeated write rounds and read passes per candidate location
  • Reports an estimated safe range, never presented as full verification

Deep Test

Once the fast search has identified a plausible boundary, Deep Test answers a different question: not “where does the fake capacity begin?” but “is the part we intend to keep actually reliable?”

  • Tests only the range already identified as potentially usable
  • Writes the entire region first, then verifies it in a separate pass
  • Expected data is regenerated from a seed, so memory stays constant
  • Reports the exact sector where verification first fails
  • Lowers the safe boundary when corruption is found earlier than expected
  • A cancelled or partial run is never reported as verified

Safe partition creation

After a reliable size has been established, the utility creates a partition that stays inside the validated capacity, leaving an 8 MiB guard zone below the boundary. Partition size is always rounded down, never up. The result is a counterfeit device that works honestly at its real size instead of silently losing data past the fake boundary.

Reported capacityThe size advertised by the USB controller and seen by the operating system.
Detected usable capacityThe region that survives Quick Test and defines the candidate safe boundary.
Deep-verified capacityThe region subsequently subjected to full sequential write/read verification.
Safe partitionAn exFAT partition sized to remain inside the verified region.

Why this approach is faster

A conventional sequential tester has to write through the advertised device space before it can prove that the end of that space is fake. On a device claiming terabytes, that can take days.

Reported USB sizeMay include a large fake address range.
Quick boundary searchLocate the last genuinely addressable region in seconds.
Deep verify safe areaSpend full-test time only where storage may really exist.

Validated against a real counterfeit device

A USB stick advertising 2.1 TB, built around an ITE controller whose product identifier had been left at the reference-design placeholder value:

FigureWhat it measures
2.1 TBCapacity advertised by the controller — 4,096,000,000 sectors of 512 bytes
14.56 GiBReal usable capacity, reached by Quick Test in six seconds at sector 30,535,679
×134Ratio between the capacity claimed and the capacity actually present
0 errorsDeep Test wrote and read back the entire usable region
0 bytesCorruption found by an independent H2testw run across the resulting exFAT partition

Sequentially testing the advertised 2.1 TB would have taken days. The boundary search took six seconds, and the deep verification then had only 14.56 GiB to cover.

Device information

An information panel collects what is safely available from the device and the operating system — USB vendor and product identifiers, serial number, bus type and version, logical and physical sector sizes, removable and hot-plug status, and mounted volumes.

Every row states where its value came from: reported by the hardware, supplied by Windows, computed by the application, or measured by a test in the current session. That distinction matters on this kind of device, where the reported capacity is precisely the value that cannot be trusted. The panel does not claim to read the real flash capacity out of the controller, because no supported command exposes it.

Safeguards

  • The disk carrying the running operating system is rejected outright
  • A USB-attached Windows To Go system disk is not treated as safe merely for being USB
  • Destructive testing stays disabled until the risk is explicitly acknowledged
  • Existing partitions trigger a request plus two separate destructive confirmations
  • Declining any confirmation stops the run before a single sector is written
  • An unpartitioned device starts testing without unnecessary prompts
  • Mounted volumes are locked and dismounted so raw writes are not silently refused
  • Long operations run off the interface thread and remain cancellable throughout
Important distinction: Quick Test identifies a candidate usable range and is deliberately not described as full verification. Deep Test provides stronger evidence, but even a clean result means the tested data was written and read back correctly during that run — not that the flash will never fail later.

Deployment

The application is a single portable executable with no installer, no service and no registry configuration. It requests administrator rights on launch, which raw physical-disk writes require on Windows. A diagnostic log is available but hidden by default, and reports each stage of a run for troubleshooting.

Current project status

Version 1.0 is complete. Quick Test, Deep Test, safe partition creation, device information, progress reporting, the diagnostic log and the safety confirmations are all implemented and have been validated both against a simulated counterfeit device and against real hardware, with the end result confirmed by an independent tester. The public Windows release package is not yet published on sothis.dev, so this page intentionally does not provide a placeholder executable or source-code download.