PC-3000 Flash. How to spot a fake monolith and memory chips

This article will be helpful in Data recovery and also can be used in everyday life.

The fake flash card is the same as a fake of any other item – it looks like something else, not what it really is. This is usually done to artificially add up some value to it.
For example, you have 64GB flash card. It shows 64GB, looks like 64GB, smells like 64GB…
It must be 64GB? Not always. There are many sellers who are selling re-marked flash cards.

The card may be 8GB inside, but stamped “64GB” on the outside.
The problem is that this card can store up to about 8GB of data, while anything higher will be lost.
Also there are a defective fake card. For example it’s 1 GB but actually chip have 2 GB inside.
How it’s possible? – manufacture has recognized that the card is defective and reprogrammed the controller for smaller capacity. As a result controller use only half part of whole capacity.
But also please note that if card has few parts inside (2 or 4) another parts can be not recognizable due to dirty pins.
Finally, reader can’t recognize Chip Enable (CE) pins of other reading channel(s) on the card and needs to try to clean up the pins and try to read Chip ID again.
Terminology and numbering of signals article

As you know, each Micro SD card has two main parts:
Controller and raw flash chip.
While the flash chip has its fixed size (i.e. 8GB), the microcontroller can be programmed to report anything.
This way a fake card’s microcontroller reports 64GB, while the flash chip stays 8GB.

Operation system may show 64GB when you check for the size in card’s properties, but OS does not really measure or check the size.
All it does is asking the card’s microcontroller about its capacity and if the microcontroller is re-programmed to report higher capacity, you’ll see what card had decided to report, not what the card can actually store.
So, for example user have fake 64 Gb card (actually it’s 8 Gb capacity).
While he uses only 8 Gb of all space everything is OK, but when he tries to write more than 8 Gb new data will overwrite the old (early) of them.
Bassically partition files (like Boot, MBR, FAT tables) are not affected and partition still work properly, but sometimes controller rewrite these partition files by users data.

How to spot a fake Micro SD and SD cards

Some sellers know exactly that they are selling fakes, some may not be even aware of it. Our goal is to try to properly spot the card that we have from customer, and be able to understand why we get just 8 Gb dump in Flash utility instead of 64 Gb.

Here are a few criteria to recognize a fake card just by looking at seller’s pictures:

Card Type

It means that if you get 64GB or higher, it must be SDXC. If you see “64GB SDHC” or “64GB MicroSDHC”, this is 100% fake just because “64GB MicroSDHC” is inconsistent labeling.
Please note how SDXC logo differs from SDHC logo.

Packaging

As mentioned earlier, if the card you are buying is 64GB or higher, but the packaging said “MicroSDHC” or “SDHC”, then this is fake.
The majority of fake SD cards have poor packaging and missing graphics elements compared to their originals.
For example, all Samsung-like fake cards never show capacity on the packaging, while original Samsung does.

Also, sometimes packaging does not match with the card.
Package can be marked like “Sandisk Ultra”, but the card inside had “Sandisk Extreme” on it.

This is fake too.
Also there are some cards where packaging said “Class 10”, but the card had “Class 6” on it.
That’s another reason to realise this is fake.
And of course, if the packaging says “MicroSDHC”, but the card has “SDXC” logo or another way around, this is fake.

Card (Front side)

First, check to make sure the family of card matches with its capacity. For example, SDXC logo must be presented on all cards with 64GB and higher. If it does not match, this is fake.

Also, you can check on the manufacturer’s website to see how the card looks like. For example, there are several Sandisk 128GB Micro SD cards colored differently from the original Sandisk as shown on Sandisk website (that’s despite showing “SDHC” instead of expected “SDXC” logo).

Additionally you can compare the original picture from manufacturer’s website and look for any differences. Most of the time font type is different and alignment is off.

Card (Back side)

Please note that all modern fake cards basically have the following on the back:

MMB3R08BUACA-GE (part number)
XL8B20140105 (date code, may vary)
Made in Taiwan

The same part number was on all fake Micro SD.
It appears that “08“ part in the part number shows the actual capacity of the card – it’s 8GB.

If you see such part number on the back, this is fake (unless you have original 8GB card which is unlikely).

Some known variations are:

MMB3R08GUACA-GE, MMB3D08BUACA-GE, MMB3D08GUACA-GE, MMB3R08GUACA-GE.

Datasheet of memory card

If you could not spot the card using any methods and still suspect that the card may be fake then you can try to find a datasheet of it.
Read Chip ID by PC-3000 Flash reader and try to find Datasheed document by Controller mark value.

Let’s take a look on these screenshots:

Here we have a chip marking K9GAG08U0M with 2 Gb dump, but card marked like 1 Gb.
If we take a look in Service information widnow we have such view:

Few pages are filled by data, but others are filled by “FF” pattern.
Such view mean that this card is defective and it was reprogrammed by the manufacture.
Let’s try to find datasheet for this chip.
We need to use chip marking information. For this case it’s K9GAG08U0M.

As we can see it’s really 2 Gb memory chip.

Another example is when “FF” pattern can be recognized with big step value.

Let’s take a look these screenshots:

Here we have MT29F64G08CFAAA chip marking and if we check Service information window with “1024” step value we can see that card has block of user data and block with “FF” pattern:

For solving such case we need to separate actual data and “FF“.
In this task we need to use Split by block preparation and then Join by dumps step.

Well, here are the backs of the following fake cards: Sandisk, 2 x Samsung, ADATA and Generic.

Can you guess which one belongs to each brand? Yes, they all have the same part number on the back – MMB3R08BUACA-GE.
As result all of them are fake.

Please note that often fake cards are selling at auction (like AliExpress, eBay and other). If you see suspiciously low price relative to the price of neighboring offers – probably it’s fake.

Be careful and good luck! 😉

Check out new adapters for PC-3000 Flash