Flash drive weirdness

pcalvert · 2025-10-22 08:38:14

I recently purchased some USB flash drives in order to create bootable installation drives and a portable installation of Devuan. I was checking them out last night and noticed something that (to me) seems a bit strange.

This is for a "128 GB" USB flash drive:

# fdisk -l /dev/sdb
Disk /dev/sdb: 115.43 GiB, 123941683200 bytes, 242073600 sectors
Disk model: USB DISK 3.0    
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xc1a97bb4

Device     Boot Start       End   Sectors   Size Id Type
/dev/sdb1       97664 242073599 241975936 115.4G  c W95 FAT32 (LBA)

And this is for a "32 GB" USB flash drive:

# fdisk -l /dev/sdb
Disk /dev/sdb: 28.91 GiB, 31037849600 bytes, 60620800 sectors
Disk model: USB Flash Drive 
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x1e67b218

Device     Boot Start      End  Sectors  Size Id Type
/dev/sdb1  *       64 60620799 60620736 28.9G  c W95 FAT32 (LBA)

Of the two, the 128 GB drive is the one that looks weird to me. Notice where the partition starts. I've never before seen a flash drive with that much "empty" space before the first partition. Does anyone have any idea of what's going on, or might be going on, with this drive?

Altoid · 2025-10-22 11:11:25

Hello:

pcalvert wrote:

... 128 GB drive is the one ...

Is this how it came 'out-of-the-box' or did you format it?

You may want to run a read-only check on it with dosfsck and/or have a look at it with the gnome-disk-utility
It shows things that Gparted will not.

Best,

A.

pcalvert · 2025-10-22 11:38:19

Altoid wrote:

Is this how it came 'out-of-the-box' or did you format it?

The drive came that way. All I did was run that fdisk command and mount the partition to see if the drive came with any documents or software (it didn't).

Altoid · 2025-10-22 12:18:38

Hello:

pcalvert wrote:

... came that way.

I see.
I assume it came in a sealed blister package without any indication of use.

I have never seen a USB drive with what you see in your fdisk printout but one never knows.
I have read that memory prices are surging lately, mainly due to dwindling stocks and foundry production having reached their limit.

It would be interesting to know the brand/model of your USBs.

It may well be that (for whatever commercial reason) the chip in the 128Gb drive is a higher capacity (eg: 256Gb or higher) but with the firmware blocking access to those sectors due to it being sold at 128Gb prices or because it is damaged and instead of binning it, the OEM decided to sell it as a 128Gb device.

That said, the only (?) answer to your OP may lie in checking the drive as suggested.
ie: a read-only check on it with dosfsck and looking at what the gnome-disk-utility says about it.

You may also want to check read/write speeds with the gnome-disk-utility, I had a nasty surprise from Kingston some time ago.
If interested see here: https://dev1galaxy.org/viewtopic.php?id=7264

Whatever the result, do let us know what you find out.

Best,

A.

pcalvert · 2025-10-22 13:04:59

Altoid wrote:

I assume it came in a sealed blister package without any indication of use.

Yes.

Altoid wrote:

It would be interesting to know the brand/model of your USBs.

The 128 GB flash drive is a Silicon Power Blaze B02, and the 32 GB flash drive is a Lexar JumpDrive V100. By the way, the Lexar drive came in a pack of three, and one of the three is clearly defective (much slower than the other two).

rolfie · 2025-10-22 13:08:26

A check if the memory on the stick really is the advertized one can be done with the f3 utility.

The first thing I do with any USB stick I buy.

Last edited by rolfie (2025-10-22 13:43:38)

stargate-sg1-cheyenne-mtn · 2025-10-22 14:05:06

these might be of some value:

https://www.theregister.com/2024/02/07/failed_usb_sticks

https://arstechnica.com/gadgets/2024/02/rejected-chips-hidden-microsd-cards-plague-the-usb-stick-market/

https://forum.tinycorelinux.net/index.php/topic,26762.0.html

https://forum.tinycorelinux.net/index.php/topic,26778.0.html

.

pcalvert · 2025-10-22 14:25:13

rolfie wrote:

A check if the memory on the stick really is the advertized one can be done with the f3 utility.

Yes, I did that for the three Lexar drives. I didn't do that for the Silicon Power drive because I didn't have time, but I will. However, that is not my main concern. At this point, I am mainly concerned about the "weirdness" of the Silicon Power drive.

I consider all "foreign" (new to me) flash drives as potentially hostile hardware. Because of that, the unusually large amount of "empty" space before the first (and only) partition of the Silicon Power drive is concerning. Could there be malicious code hiding in there?

Since I was planning on doing it anyway, I am going to go ahead and wipe the drive. I will then format it and use f3 and flashbench to conduct some tests on the drive. Oh, and as a precaution, before doing that I will use dd to back up the MBR and partition table in case I need (or want) to restore them for some reason.

fsmithred · 2025-10-22 16:52:43

Look at the whole device in hexedit to see if there's any code at the beginning. I don't have any usb stick that I haven't re-partitioned to tell you what it should look like. Maybe image the image it with dd if you want to examine it later.

I think I may have seen similar on a 128 or 256G and didn't think much about it before I re-partitioned. Or I could be imagining it. FWIW, my 128 and 256G sticks suck compared to 32. They're s - l - o - w.

I read about micro-sd cards hidden inside usb sticks. Last time I looked at them in the store, they had combo packs with "USB and micro-sd". They no longer hide the micro-sd - they let you insert it into the usb housing yourself.

Calamity · 2025-10-22 18:11:41

I have a 64G TeamGroup drive that I use regularly, when I looked at it in Gparted I also saw a chunk of unallocated space at the beginning. It was quite small, but still noticeable, maybe about 20MB. I reformatted it to use all the space available, did not suffer any data loss so far but of course with such oddities going on it's best to keep backups everywhere you can... It's also supposed to be USB 3.0 but is very slow on writes. Flash memory is getting very sketchy, a lot of people complain, especially when it comes to bigger capacity drives/cards.

Got another 64G drive by Kingston (bought together with the first one), that one came preformatted as FAT32 instead of ExFAT for some reason... Strange.

Here is another good page on the subject of fake flash drives: https://rmprepusb.com/tutorials/007-all … sh-drives/ .

pcalvert · 2025-10-25 13:39:51

fsmithred wrote:

Look at the whole device in hexedit to see if there's any code at the beginning.

I did that last night. Fortunately, I didn't see anything suspicious. Mostly just lots of zeroes.

pcalvert wrote:

By the way, the Lexar drive came in a pack of three, and one of the three is clearly defective (much slower than the other two).

The slower Lexar JumpDrive definitely seems flaky. This morning I ran fdisk -l /dev/sdb to give it a quick look and got "Permission denied". So I tried again as root and it still didn't work. Then I tried sudo wipefs --all /dev/sdb, and that got things working again. Even so, this doesn't seem like a good sign. I have strong suspicion that this drive is going to be unreliable or end up dying early. I still have time (a few days) to return the drives for replacement or a refund, so maybe I should go ahead and do that.

stargate-sg1-cheyenne-mtn · 2025-10-26 14:04:21

definitely return them

Duke Nukem · Yesterday 10:54:53

Couldn't you just wipe the whole thing and re-format it? Or are there some special data blocks at the start of flash drives and SD cards etc?

kapqa · Yesterday 13:30:41

you could try this rpgrogream

https://www.sdcard.org/downloads/formatter/

it is bit tricky to funciton on linux

https://www.sdcard.org/downloads/sd-mem … for-linux/

( manual)

Calamity · Yesterday 16:22:53

A Linux equivalent for SD Card Formatter is the blkdiscard command, but it's quite risky to use - can only be used in 'forced' mode due to a bug and probably won't work at all if using a usb card reader instead of an integrated one.

Use blkdiscard
In short:
blkdiscard /dev/mmcblk0
Discussion
To quickly erase an entire SD card, you can use the blkdiscard(8) command. This calls the Linux BLKDISCARD ioctl, which in turn passes CMD38, the same as SD Memory Card Formatter.
Interesting options
-s, --secure securely discard blocks. As has been pointed out elsewhere, a normal CMD38 will make some blocks appear empty, but leave others plainly visible due to garbage collection. Use -s if you wish to be a little more secure and force garbage collected blocks to also be erased.
-z, --zero zero-fill blocks rather than discard.
Does not work over USB
Note that while this works on my laptop and Raspberry Pi, it would not work on a USB SD card reader. The difference is that kernel needs to have access to the low-level MMC subsystem, which USB abstracts away as a generic "mass storage" device. [I believe Microsoft Windows has the same limitation, but please correct me in the comments if I'm wrong.]
If you do not have a device that can speak directly to the low-level SD card, it is possible to build one out of an Arduino and run SDFormatter.ino.
Extraordinarily dangerous!
Since blkdiscard must be run as root, it can easily destroy all of your data. You better be sure that you are pointing it at the right device and then double-check again. Use lsblk and df.
The manpage claims that, to be safe, it will only work if the drive isn't already mounted. That would be a nice safety feature, but it is not true as of this writing. The current implementation requires the -f, --force option if the drive is already formatted, which is (almost) always going to be the case since SD cards come pre-formatted. Unfortunately, using --force means that all checks, including if the drive is in use, are disabled.
Hopefully someday Linux will allow blkdiscard to be run on removable devices without requiring root privileges which would make it much less dangerous.
Other uses
Besides quickly wiping out data for privacy, supposedly blkdiscard, similar to fstrim for an SSD, will improve wear-leveling and make some SD cards generally run a little bit faster.

pcalvert · Yesterday 19:14:36

Duke Nukem wrote:

Couldn't you just wipe the whole thing and re-format it?

I tried doing that. I wiped the drive using the command wipefs --all /dev/sdb and created a new partition using cfdisk (and later sfdisk). I then attempted to format the partition using mkfs.vfat /dev/sdb, and that failed (multiple times). These drives are going back to Amazon.

Andre4freedom · Today 09:16:32

Just some hints:

sudo wipefs --all /dev/sdb

only wipes all signatures on that disk.

to wipe a disk completely:

dd if=/dev/zero of=/dev/sdb

as root user! And be pretty sure what you do, any targeted disk will be written to, so know that your device is /dev/sdb. You may check with lsblk

Then, when you use a tool like cfdisk or sfdisk or any fdisk, you are going to partition a disk. You then want to install a filesystem on a partition, not the whole disk!
Example:

sudo mkfs.vfat /dev/sdb1

sudo mkfs.vfat /dev/sdbn (n=your new partition number, i.e. /dev/sdb1)

You can format a complete device without any partition on it like /dev/sdb for special uses. This reminds us of olden times when we used floppy disks.

Man pages are there to help!

chris2be8 · Today 17:14:33

Doing something like dd if=/dev/zero of=/dev/sdb I would (starting without it plugged in):

lsblk
# Plug in the flash drive
lsblk
# Look for a device that has just appeared
sudo dd if=/dev/zero of=/dev/sdb

Make SURE of=/dev/sdb points to the new device *before* pressing enter!

I've been burnt enough times to check, recheck and triple check dangerous commands.

The officially official Devuan Forum!

#1 2025-10-22 08:38:14

Flash drive weirdness

#2 2025-10-22 11:11:25

Re: Flash drive weirdness

#3 2025-10-22 11:38:19

Re: Flash drive weirdness

#4 2025-10-22 12:18:38

Re: Flash drive weirdness

#5 2025-10-22 13:04:59

Re: Flash drive weirdness

#6 2025-10-22 13:08:26

Re: Flash drive weirdness

#7 2025-10-22 14:05:06

Re: Flash drive weirdness

#8 2025-10-22 14:25:13

Re: Flash drive weirdness

#9 2025-10-22 16:52:43

Re: Flash drive weirdness

#10 2025-10-22 18:11:41

Re: Flash drive weirdness

#11 2025-10-25 13:39:51

Re: Flash drive weirdness

#12 2025-10-26 14:04:21

Re: Flash drive weirdness

#13 Yesterday 10:54:53

Re: Flash drive weirdness

#14 Yesterday 13:30:41

Re: Flash drive weirdness

#15 Yesterday 16:22:53

Re: Flash drive weirdness

#16 Yesterday 19:14:36

Re: Flash drive weirdness

#17 Today 09:16:32

Re: Flash drive weirdness

#18 Today 17:14:33

Re: Flash drive weirdness

Board footer