Fake memory cards

By | May 20, 2019

Not a week goes by where I am not confronted with loss of digital photos caused by fake memory cards. The sad news is that as these photos were never actually saved to the card they can’t be repaired nor recovered by tools like JPEG-Repair or JPEG Recovery LAB.

A 32 GB card that you may have purchased on some obscure website is in reality a 2 GB card. It masquerades its capacity to look and feel like a 32 GB file, and initially, while you are filling the first 2 GB with data, everything is fine. But once you go over the real capacity, any data that you write to the card is lost. The card doesn’t complain, the operating system or your camera don’t notice. Everything seems to work, but in reality your movies and photos are never written to the card.

Some times faking is done even simpler, they just change the label. This card was sold via Amazon by this seller.

Fake memory card explained

A fake memory card offers less memory space that the value advertised or displayed on the physical card. The cards firmware is ‘hacked’ to make your camera believe that fake capacity too. And even when photo data is written to no existent memory, the firmware reports to the camera that all is well.

As file system structures on FAT based file systems as used on memory cards such as the ROOT folder are typically towards the start of the drive, all appears okay from this perspective as well. Files appear with valid names, dates, attributes etc.. However, assume 2 GB actual capacity vs. a 32 GB advertised capacity, all data written past 2 GB is never actually saved. By definition this data is beyond repair or recovery.

Fake vs real SD Card
  • Actual capacity lower than capacity displayed on the card
  • Hacked firmware

— ROOT ————– | actual capacity > files written this point beyond don’t exist
— ROOT ————– | xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx | Advertised capacity

ROOT is a directory structure containing files and folder stored in the root of the drive (like DCIM). As this located at the start of the drive, all files appear to be present.

Typical symptoms

Just prior to the corrupted photos there is one in which only the top half is present and the lower half is grey

Customer comment

Files saved at the start of the drive (memory card) can be viewed and opened normally.

Then often there is a file where the image is partially displayed while the bottom part of the image is typically grey / solid color. From that point of the photos can not be opened and do not show previews in Windows Explorer.

When opened in a hex editor the file that partially displays contains only zeros from a certain point on. Files after that contain zeros only.

File created on fake memory card

Camera created a file, with a filename, but the data was never stored.

Prevention

It is not easy to recognize fake cards but in general they will be less expensive than the same brand and type of card from a reputable website or dealer. If it looks too good to be true then it probably is.

After purchase you can check the card using utilities specially designed for the purpose, Raymond.cc lists several.

Test if you have a fake memory card

Leave a Reply

Your email address will not be published. Required fields are marked *