USB Memory Stick Forensics

As you can see, Father Clarke's fake memory stick has a holographic sticker on it masquerading it as a 2 GB storage device, however, it is only 1 GB because the single Hynix HY27UU08G5M IC that is inside has a 1 GB storage capacity. The Microcontroller chip is iCreate i5128, which someone in The Far East has learned to hack to misreport the memory capacity.

This is what happens when you buy a USB Memory Stick from toe-rag sellers on eBay. There is no point in complaining either, as the toe-rags that sold this to Father Clarke will have run away long time ago.

If you have bought memory sticks on eBay, it is a good idea to make sure that it truly has the storage capacity it claims to have. The first thing to do is to fully backup all the data that you currently have. The easiest way for a non-technical person to check is by storing many large files to the memory stick up to the capacity it claims to have. Then copy those files back to the computer hard disk, and if the PC cannot read all the files, then it will report a copy error and you will know. The best thing is to contact eBay straight away for a full investigation.

H2testw

One free reputable program that checks the storage capacity and reports any errors is H2testw. It is best to obtain it from the author’s site; otherwise, you will end up going in circles on the other sites without ever being able to find it.

It simply writes to a target destination on the memory stick and does not delete any existing data or do low-level tricks. This program is only for a working USB memory stick. If you suspect your memory, stick to be faulty then do not use this software.

NAND Memory Chip

The NAND flash storage chip is the main storage component. It looks like an original component, and must have worked. However, some sellers on eBay will attach fake labels on the memory stick and modify the ROM code so that the stick falsely reports to have a 2 GB storage space, when in fact it has only 1 GB storage capacity.

When the 1 GB storage space is full, the user remains unaware because there is no error message to let the user know. The user will continue to store files without ever realising that those files were not being stored! Moreover, when they try to access those files some weeks later, the data will not be there!

Decoding Memory Chip Serial Number

Hynix HY27UU088G5M is most definitely a 1 GB memory chip. It appears to be a genuine chip with a matt surface finish.

This Article Continues...