f3 icon indicating copy to clipboard operation
f3 copied to clipboard

document f3probe assumptions

Open jowagner opened this issue 5 years ago • 2 comments

My brief inspections of the code suggest that f3probe assumes sector wrapping with a modulus that is a power of 2. Is this correct? It would be great to add a sentence or two in the readme what type of fake drives it can detect and what its limitations are. For example, can it detect a 2 TB fake drive with a 320 GB internal disk where 512-byte sector indices are wrapped modulo 625000448?

jowagner avatar Aug 26 '20 12:08 jowagner

Your interpretation of the code is correct: f3probe assumes that sector wrapping in fake drives is a power of 2.

An explanation of the algorithm would be nice to have, but it hasn't made to the top of my priority list. For now, the code is the only in-depth documentation.

I've designed the algorithm of f3probe based on my knowledge building low-level hardware, assumptions like "counterfeiters won't add hardware to hide it is fake because it would reduce profit or even incur a loss", and my accumulated experience with fake drives. Notice that f3probe has been tested in the wild and, as far as I know, the only improper report is the one in issue #104. I don't know what happened then and I haven't had a drive with that behavior on hand to explore that issue.

f3probe would not detect the fake drive you conceived for your example, but I doubt that counterfeiters are selling that drive because a modulo 625000448 on cheap hardware would be quite slow. Counterfeiters are only using cheap tricks to make a pitiful profit. Were counterfeiters bent on hiding that a drive is fake, only something f3write/f3read, or f3brew would work. Just to give you an example of their lack of willingness to push the development of fake drives, consider the following: I have received, for many years, messages of people concerned that given the fact that F3 is open source, counterfeiters would copy the random number generator to break f3write/f3read, or f3brew. While this is possible, they have never done it. Had they done it, F3 wouldn't bother to maintain compatibility with H2testw. H2testw is older than F3, which itself is 10 years old now.

AltraMayor avatar Aug 26 '20 12:08 AltraMayor