Consumer Protection
Counterfeit SD Cards
A fake card reports storage it does not have. You find out when the recording you already made turns out to be empty.
Counterfeiters buy low grade flash, reprogram the controller to claim a much larger size, and sell the result as a name brand card. It formats normally. It copies files normally. It passes every check most people know how to run. The failure only appears once writes cross the true capacity of the flash inside, and by then the recording is usually gone.
A test on arrival finds this before it matters. Run a write-verify test on the card the day it arrives, before it goes anywhere near a paying job.
A counterfeit SD card reports more capacity than its flash physically holds. Test it with a write-verify tool, H2testw on Windows or f3write and f3read on macOS and Linux, which fills the card and reads every byte back. Data written past the real capacity was discarded or overwritten by the controller, and no lab can recover it.
How do you tell if an SD card is fake?
Write a known pattern across the whole card, then read every byte back and compare. A card that reports more space than it has will fail at the point where the real flash runs out. This is the only check that proves capacity, because it is the only one that does not take the card's word for anything.
Three rules apply to every tool below. Run the test on an empty card, because the test fills all free space. Expect it to take hours on a large card, since it writes and then re-reads the entire capacity. Delete the test files when it finishes.
Run a write-verify test on Windows
H2testw is the standard. It is frozen at version 1.4 and no longer gains features, which does not matter, because writing data and reading it back does not go out of date. Get it from Heise, the publisher of c't magazine, where it has always lived. It runs without installation and without administrator rights.
Click the English button at the top left, choose Select target and pick the card, leave the data volume on all available space, then click Write + Verify. It writes 1GB files named 1.h2w, 2.h2w and so on until the card is full, then reads them back. A genuine card finishes with a message that the test found no errors. A counterfeit reports how much data was lost, corrupted, or overwritten, and gives the byte offset of the first error.
Run a write-verify test on macOS or Linux
F3, short for Fight Flash Fraud, does the same job. Install it with brew install f3 on macOS or sudo apt install f3 on Debian and Ubuntu. The two commands below take the card's mount point, not its device node. Run the write pass first and the read pass second.
macOS
f3write /Volumes/UNTITLED
f3read /Volumes/UNTITLEDLinux
f3write /media/username/SDCARD
f3read /media/username/SDCARDRead the f3read summary line by line. Data OK is the capacity that genuinely holds what you wrote. Data LOST and Corrupted are the space the card claimed but could not store. Overwritten means f3read found valid pattern data belonging to a different offset, which is the signature of a controller wrapping writes back over earlier ones. A genuine card reports zero in every category except Data OK.
Probe the real capacity in minutes instead of hours
f3probe skips the file system and writes straight to the block device, so it finds the true capacity in minutes rather than filling the card. It ships in the Debian and Ubuntu package. Homebrew does not build it, so on macOS the write-verify pass is the test available to you.
f3probe destroys everything on the card. It wipes the partition table and the file system. Use it on a new card you have not written anything to, unmount the card first, and run it against the device node as root.
Linux, destructive
lsblk
sudo umount /dev/sdb1
sudo f3probe --destructive --time-ops /dev/sdbIf f3probe confirms the card is smaller than advertised, f3fix writes a partition table confined to the real capacity, which makes the card safe to use at its true size. That is a way to salvage a cheap card for throwaway work. It is not a repair, and the flash inside is still whatever the counterfeiter could source.
Start from the card you have
A card just arrived
Test it now, while the return window is open and before it holds anything you care about. Run the write-verify pass above, keep the packaging and the receipt until it passes, and only then put it in a camera or a recorder.
A card that fails is a return, not a repair. Report it to the marketplace and to the brand whose name is on it.
A recording is already missing
Stop writing to the card. Do not reformat it, do not let a device record over it, and do not run a repair utility that writes to it. Every write after the loss reduces what is still there.
Then work out which failure you are looking at, because one of them is recoverable and one of them is not. Compare the two counterfeit data loss cases before you spend money on anything.
Physical inspection catches only the lazy fakes
Nothing on the outside of a memory card proves how much flash is inside it. Printing, holograms, and packaging are all reproducible, and the good counterfeits reproduce them well. Inspection is worth two minutes because it catches the careless end of the market, and it settles nothing on its own.
Read the table below as a filter, not a verdict. Anything in the fake column is a reason to send the card back. Nothing in the genuine column is a reason to trust it.
| Signal | Genuine card | Often seen on fakes | What it actually proves |
|---|---|---|---|
| Markings on the back | Laser etched serial and country of manufacture | Blank back, or printing that rubs off | A blank back is disqualifying. SanDisk states cards with no rear markings are not made by SanDisk. Correct markings prove only that the counterfeiter copied them. |
| Advertised capacity | Up to 2TB in microSD as of August 2026 | 4TB or 8TB microSD offered for immediate shipping | A capacity above what any manufacturer ships at retail is proof of a false claim on its own, with no test required. |
| Price against retail | In line with the manufacturer store and major retailers | A fraction of the going rate for the claimed size | A price far under retail is a reason to look harder. Counterfeits are also sold at full price, so a normal price proves nothing. |
| Retail packaging | Sharp print, consistent part number, sealed blister | Soft or misregistered print, mismatched part number | Packaging quality tracks how much the counterfeiter invested, not what is inside the epoxy. |
| CID register read in software | Plausible manufacturer ID, product name, and date | Plausible values, copied from a real card | Nothing about capacity. The CID is data the controller reports, and a controller that lies about size can report any CID the counterfeiter chose. |
| Sustained write speed | Close to the speed class printed on the card | Collapses to a few MB/s on large transfers | Low grade flash and a cheap controller, which is a strong hint. Speed alone does not locate the capacity boundary. |
| Full write-verify pass | Every byte read back matches what was written | Data lost, corrupted, or overwritten past a fixed offset | The real usable capacity, measured directly. This is the only row that settles the question. |
Every signal above except the final row can be forged, copied, or coincidental. Treat inspection as triage and let the write-verify test decide.
“microSD, and SD cards with no rear markings, or that look like these counterfeit cards are NOT made by Sandisk”
“these fakes look totally normal at first. They'll format just fine, copy some files, and overall work as intended. Until you hit that invisible limit and start writing data past the real, hidden capacity of the microSD.”
Why a counterfeit card reports the wrong capacity
A memory card is a small computer. A controller inside it runs firmware that manages error correction, bad blocks, and the mapping between the addresses a host asks for and the physical flash pages that hold the data. Change that firmware and you change what the card says about itself.
Andrew Huang documented the mechanism in 2013 after watching it done in the electronics markets in Shenzhen. The tools involved are the mass production utilities that controller vendors ship for factory initialization, which set the vendor ID, the product ID, and the capacity the card reports.
“they load a firmware that reports the capacity of a card is much larger than the actual available storage”
The number the host reads comes from the card's CSD register, which it queries during initialization, before any file system is mounted. The operating system then partitions and formats the card to match. Every layer above the controller is working from a figure the controller supplied.
The flash behind that figure is usually whatever was cheap. Huang found the quality varied across the whole possible range, including chips recovered from scrapped hardware.
“It can be anything from high-grade factory-new silicon to material with over 80% bad sectors.”
Wrap-around writes destroy what is already on the card
One family of counterfeit firmware masks the address instead of rejecting it. A write aimed past the real capacity comes back around to a low physical address and lands on top of data already stored there. Writing into the ninth gigabyte of an eight gigabyte card overwrites the first.
FAT32 and exFAT both keep the boot record, the allocation table, and the root directory near the start of the volume, which is exactly where a wrapped write lands first. That is why these cards tend to fail all at once: the card works, then a large transfer wraps, and the volume comes back as raw or asks to be formatted.
Acknowledge-and-discard writes never reach a die
The other family accepts the write, reports success to the host, and throws the data away. Nothing is overwritten, so the file system stays intact and the directory listing keeps showing correct names, sizes, and timestamps. Read those files back and the payload is zeros, 0xFF, or a repeating filler pattern.
0xFF is what NAND flash reads as when it has been erased and never programmed. A file that is 0xFF end to end was never written, which is a different fact from a file that was written and then damaged.
Definitions for controller, reported capacity, and wrap-around writes
- Controller
- The processor inside every SD and microSD card. It runs error correction and bad block management and presents the flash to the host as one continuous volume. Huang describes it as typically a heavily modified 8051 or ARM CPU.
- Controller firmware
- The software the controller runs. Factory mass production tools write it, including the values the card reports for vendor, product, and capacity. Counterfeiting a capacity means rewriting this.
- Reported capacity
- The size the card tells the host it has, read from the CSD register at initialization. Operating systems format to this number because there is no other number available to them.
- True capacity
- The storage the flash dies physically provide. On a counterfeit card this is smaller than the reported capacity, and a write-verify test measures where it ends.
- Wrap-around write
- A write past the true capacity that the firmware redirects to a low physical address, overwriting stored data. It usually destroys file system structures first because those sit at the start of the volume.
- Write acknowledgement
- The controller's reply confirming a write completed. Counterfeit firmware sends this reply for data it discarded, which is why a camera or recorder shows no error while producing empty files.
For the layers underneath, see how NAND flash cells store data and what the flash translation layer does when it maps a logical address to a physical page.
What happens to a four-hour recording when the card lies
A long unbroken recording is the worst thing you can put on an untested card. Most recording formats finish their index when the file closes, so a card that fails partway through can cost the whole take rather than truncating it at the point of failure.
Field recorders finalize the WAV header when you press stop
A WAV file is RIFF chunks, and two of those chunks carry sizes the recorder cannot know until recording ends. The device writes placeholder values, streams raw PCM after them, and seeks back to patch the real byte counts on close. Lose the card or the power before that, and the file has audio in it that most players will not open, because the header says the data chunk is empty.
That failure is repairable when the audio reached the flash: the payload is uncompressed and sequential, so patching the two size fields to the real byte count makes it play. It is not repairable when the payload was discarded, because patching a header does not put samples back.
File splitting sometimes saves part of a long take by accident. Recorders close a file and open a new one at the 2GB or 4GB mark, and each file that closed cleanly got its header finalized on the way past.
Video containers keep the index at the end
MP4 and MOV store the media in an mdat box and the index in a moov box that maps every frame to a byte offset. A camera recording progressively cannot build that index until it stops, so it writes moov last. Without it a player has the video data and no way to find frame one.
Some cameras mitigate this. Fragmented MP4 writes an index per segment, so only the last few seconds are at risk. Sony prompts to recover its database, and GoPro offers to rebuild the file when it next boots. Cheaper devices leave an orphaned file and no tooling.
Dashcams and CCTV fail on a different schedule
Loop recorders write short segments and delete the oldest to make room, so a single failure costs minutes rather than hours. The exposure is different: the system keeps running and nobody looks at the footage until something happens. A card that wraps its writes can be quietly destroying the file system while the recorder reports normal operation, and the gap is discovered on the day it matters.
Loop recording also punishes low grade flash. The same address range is rewritten continuously, which burns through program and erase cycles far faster than occasional use. High endurance cards exist for this workload, and a counterfeit is the opposite of one. If footage matters to you, read the failure patterns for dashcam and body camera recovery and for CCTV and DVR systems.
A Tascam DR-40 thread on r/datarecovery
On 15 August 2026 someone posted to the r/datarecovery subreddit about a Tascam DR-40 used to record a four hour DJ set. The post is a third-party account on a public forum. Rossmann Repair Group had no involvement in the case and has never examined the card. It appears here for the symptom pattern the poster documented in the open.
The post reports four WAV files of roughly 2GB each, sizes consistent with a long multichannel recording split by the recorder, on a card that still mounts with other recordings on it readable. The poster inspected the files in a hex editor and found them to contain 0xFF throughout rather than audio. A responder suggested a counterfeit card and described how to check for the point where data turns into 0xFF; another responded that where there is only 0xFF there is no data to recover. The poster also noted the card carries no brand name.
Nothing in that thread establishes what the card was, and no one in it tested the capacity. What it does show is the shape of the failure: intact file system, plausible file sizes, correct timestamps, and a payload that was never written. Read the original thread on Reddit.
Can data from a fake SD card be recovered?
It depends entirely on whether the data ever reached a memory die. Counterfeit cards produce two different failures that look similar from the outside and have opposite answers. Work out which one you have before you pay anyone, including us.
Case A: the data never reached a memory die
The writes crossed the true capacity and the controller discarded them, or wrapped them over earlier data and physically replaced it. Either way there are no bits on any die to read.
Nothing recovers this. File carving software scans the volume and finds erased pages. Controller level access with a PC-3000 or a Rusolut rig reads those same erased pages. A chip-off or a monolith read bypasses the controller and goes straight to the silicon, and the silicon was never programmed. Every one of those tools ends at the physical state of the flash. We cannot recover it either, and any lab that quotes you a price to try on a card in this state is selling you a dry hole.
Case B: the data landed on real flash and the flash failed
The card is counterfeit, but the writes stayed inside its true capacity, and the loss came from something else. Recycled or defective NAND developed read errors, the exFAT or FAT32 structures corrupted, the controller died, or the card stopped enumerating entirely.
This is an ordinary flash recovery job and it is often recoverable, because the bits are physically present. On a monolithic microSD, where the controller and the flash are one sealed package, that means exposing the factory test points and reading the die directly through a spider board. Monolithic microSD extraction covers how that work is done.
Low grade flash makes it harder rather than impossible. The bit error rates are high, the counterfeiter's controller applied non-standard error correction and bad block masking, and the layout often matches no known vendor template, so reconstructing the image from a raw dump takes longer than it would on a genuine card. Published pricing for this class of work starts at $200 for a functional card and runs to $1,200–$1,500 where chip level extraction is needed. If your card is in this category, SD card data recovery explains the process and what it costs.
How to tell which case you are in
- Open an affected file in a hex editor. A payload that is 0xFF or 0x00 from beginning to end was never written. Real audio and video look like varied data even when the container is broken.
- Check whether the loss starts at a consistent point. Files written early are fine and everything after a fixed boundary is empty, which points at a capacity limit. Damage scattered at random across the card points at failing flash instead.
- Check whether the card still mounts. An intact file system with correct names, sizes, and dates alongside empty payloads is the discard pattern. A volume that comes back raw or demands formatting after a large transfer is the wrap-around pattern.
- Run f3read if the card still mounts. It reports the offset where verification failed, which is the true capacity. Do this on a copy of the card if the data matters, and never run a destructive probe on the original.
- Look at what else is on the card. Older recordings that still play prove the flash under them works, which narrows the problem to the region past the boundary.
A card can also report the wrong size because its controller failed rather than because it was built to deceive. That is a different problem with a different diagnosis, covered in an SSD reporting the wrong capacity because its controller failed.
SD-3C customs seizures and enforcement figures
SD-3C licenses the SD trademarks and runs the brand protection programme behind them. Its published enforcement record is the best public measure of how much counterfeit memory moves through legitimate channels, with one caveat: the aggregate figures below were published in 2019 and have not been updated since.
“Since January 2011, SD-3C has reviewed more than 2,700 detentions worldwide, providing responses to customs officials regarding authenticity of memory cards and host products, with the vast majority of cases resulting in seizure and destruction of the counterfeit products. Worldwide seizures from January 2011 through Dec. 31, 2018, totaled 3.9 million products with an estimated retail value of more than $56 million.”
“Since 2013, SD-3C's brand protection team has successfully reported NOCIs on more than 125,000 ads offering counterfeit SD memory cards and host products on various e-commerce websites, resulting in their removal.”
Enforcement did not stop when the reporting did. SD-3C records that in December 2025 customs authorities in the United Arab Emirates seized counterfeit SD cards with an estimated retail value of $330,000.
The reason these cards reach buyers through ordinary storefronts is that the marketplaces are not the ones checking. SD-3C says as much itself.
“While SD-3C does monitor ecommerce sites, the sites themselves often do not police their sellers, so buyers should be careful when buying through a third-party seller”
One structural risk did get smaller in 2026. Amazon ran a stickerless commingled inventory system for years, where units from different sellers sharing a manufacturer barcode went into the same physical bin, so the unit shipped against an order was not necessarily the unit that seller supplied. For inventory shipped on or after 31 March 2026, Amazon requires resellers who are not the registered brand representative to apply Amazon barcodes to every unit, which keeps their stock physically separate. Brand owners enrolled as brand representatives can still use manufacturer barcodes under what Amazon calls virtual tracking.
That change narrows one specific path. It does not touch the more common one, which is a third-party seller listing counterfeit stock under its own account and shipping exactly what it received.
Buy a card you can verify
Counterfeit risk tracks one thing more than any other, which is how many hands the card passed through and whether you can name them. Buying from the manufacturer or from a retailer that is itself the seller of record removes the anonymous third party from the transaction.
- Buy from the manufacturer store or a specialist retailer. Manufacturer storefronts, camera specialists, and physical stores that stock their own inventory are the lowest risk channels, because the seller of record is a business with a name and a supply chain.
- Read the sold by and ships from line before you order. On a marketplace you want the retailer or the brand itself in the sold by field. A third-party seller name you do not recognise means the marketplace is providing logistics, not vetting.
- Check the capacity against what manufacturers ship. 2TB is the largest microSD capacity shipping as of August 2026. A listing above that is selling something that does not exist at retail.
- Price the card against the manufacturer store. A large discount is a reason to look harder at the seller. Full price is not a guarantee of anything, since counterfeits are sold at retail prices too.
- Test it the day it arrives. Run the write-verify pass while the return window is open and before the card holds anything. This is the step that makes all the others recoverable if you get one wrong.
- Keep the packaging and the receipt until it passes. A failed test is worth reporting to both the marketplace and the brand, and both will ask for proof of purchase.
If you shoot for a living, the mitigation that works during the job is redundancy rather than vigilance: dual card slots recording the same take, and offloading between sets rather than at the end of the night. Advice for working shooters is in data recovery for creative professionals, and the same reasoning applies to footage shot from a drone, where a second copy is rarely an option.
INFORM Consumers Act seller disclosure requirements
The INFORM Consumers Act took effect in June 2023 and requires online marketplaces to collect and verify identifying information from high volume third-party sellers, disclose key seller details to buyers, and give buyers a way to report suspicious listings.
The FTC defines the threshold precisely, and it is low enough that a great many sellers cross it.
“in any continuous 12-month period during the past 24 months, has had 200 or more separate sales or transactions of new or unused consumer products, and $5,000 or more in gross revenues”
Violations are treated as violations of an FTC rule, carrying a maximum civil penalty of $53,088 per violation. That figure took effect in January 2025 and is unchanged for 2026, because the annual inflation adjustment was not applied this year.
The law has teeth in practice as well as on paper. In September 2025 the FTC and the Department of Justice brought the first enforcement action under the act against Whaleco, Inc., the operator of the Temu marketplace, over seller disclosure and consumer reporting failures. Whaleco agreed to a $2 million civil penalty and an injunction.
For your own purchase, the practical remedies are the marketplace guarantee and a chargeback through your card issuer. Both work reasonably well and both have the same hard limit.
A refund returns the price of the card. It does not return the wedding, the concert, or the set. That asymmetry is the whole argument for testing a card before you use it: the downside of running the test is the time it takes, and the downside of skipping it is everything the card was supposed to be holding.