Operation Thumbo

...An attempt to rid the scourge of fake/counterfeit/hacked USB thumb/flash drives.

Thumbo.exe - Non-destructive Windows Test

To detect fake thumb drives, most people use h2testw. The two drawbacks are that [1] it takes a lot of time to run, and [2] it is destructive (altering the data on the thumb drive).

Advantages of Thumbo.exe

Thumbo.exe was written with read-only access, to ensure that it is non-destructive. It does nothing to alter the data on the drive (e.g. there should not even be any changes to the FAT or master boot record).

The other advantage is that it is usually very fast, taking under a minute to complete.

Where to Download

You can download (and run) Thumbo v0.90 here.

How to Run Thumbo.exe

You can instruct your web browser to run the program (or run it directly from whereever the file was saved).

When you start the program, a window will appear, and it will wait for you to put in the USB thumb drive (if it is already inserted, just remove it and re-insert it). The test will run automatically.

You can also run Thumbo.exe from a command prompt (DOS prompt), typing "thumbo /?" for help.

Results

The program displays some basic information, and has a display that looks something like this:

GOOD DRIVE, half full:

0000GB < 4 4 4 4 1 4 4 4 4 4 4 4 4 4 4 4 2 4 5 ! 5 1 1 1 1 5 4 4 4 4 4 4 4 5 4 5 4 4 4 4 4 4 4 4 4 5 5 4 4 1 4 5 4 4 4 3 4 5 4 4 4 4 2

0008GB 4 4 4 2 4 4 5 4 5 5 5 4 4 4 5 4 5 3 3 3 3 3 3 2 3 3 3 3 3 3 3 5 5 4 ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! 2 ? 3 2 3 2 3 3 2 3 3 3

0016GB 3 3 3 3 2 3 2 3 3 2 2 2 3 3 3 3 3 3 3 2 3 3 2 3 3 2 3 3 3 3 3 3 3 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 2 2 3 2 3 ! ! ! ! ! ! ! !

0024GB ! ! ! ! ! ! ! ! ! 4 4 4 4 5 4 4 4 4 4 5 ? 2 1 4 3 4 1 4 4 4 3 1 4 4 4 1 4 3 4 4 4 4 4

0032GB 4 4 4 4 1 4 4 4 4 4 3 4 4 4 4 4 4 4 4 4 4 4 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 3 3 3 3 3 4 5 4 4 5 5 5 4 2 5 4 4 5 4 5 4 5 3

0040GB 4 1 4 4 4 5 5 5 ?

0048GB

0056GB - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

The drive shown here is a good drive (it is mostly green with sporadic red), with the only potential warning sign being the exclamation marks (which indicates that Thumbo read all zeroes where Windows reports there should be data). In this case, it was due to some blank files that were saved.

BAD DRIVE:

0000GB 4 5 4 4 4 4 4 5 4 5 5 5 4 4 5 4 4 4 5 4 5 4 5 5 5 4 4 4 5 4 5 4 4 5 5 4 4 5 5 4 4 4 4 5 5 4 5 4 4 5 4 5 5 5 4 5 4 4 5 4 4

0016GB

0032GB

0048GB

0064GB

0080GB

0096GB

0112GB - - - - - - - - - - - -

The drive shown here is a fake thumb drive, which reports 128GB but is really just 16GB. The green section is the real 16GB (the 4's and 5's mean that there is data there, which appears to be random data). Note that every square that is red is blank, indicating that the drive returned all zeroes.

Legend:
=======
'-' -    Untested, beyond end of drive
'<' -    Before beginning of tested area
'>' -    After end of tested area
' ' -    Area to be tested
'�' -    First pass complete
'�' -    Second pass complete
'�' -    Final pass complete
0-9 -    Represents data. 0 means blank (all 0x00's).
!   -    Blank sector, but Windows reports it as part of a file

Green:   Tests as a GOOD SECTION
RED:     Tests as a likely BAD SECTION
YELLOW:  Test results inconclusive

The legend explains what the various colors and characters mean.

[Go back to the main Thumbo page]