14
2
I have a brand new Silicon Power Marvel M70 64GB USB flash drive has 45MB of unallocated space preceding the 58.89GB of available space. I don’t care about having less than 64GB since I know it’s due to 1024 based math.
What concerns me is within the size of 45MB. Why so much? 1MB is typical for alignment.
So, I loaded up a hexeditor in Linux with this command:
hexdump /dev/sdb -C | less
And I find “strings” of data like the following:
Invalid partition table. Error loading operating system.Missing operating system.
Remove disks or other media. Disk error. Press any key to restart. U.RRaA.
This program cannot be run in DOS mode.
CpaintDC. UserException. CResourceException.
An application has made an attempt to load the C runtime library incorrectly. Please contact the application's support team for more information. Attempt to use MSIL code from this assembly during native code.
That is within the UNALLOCATED 45 MB area... Shouldn't it be zeros straight from the factory? Furthermore, an identical drive (see below) has completely different sizes for the unallocated and partitioned area; it seems executable data is or was stored there
I’ve never encountered this before. Has anyone else? I called the company and they didn’t have an explanation only to tell me that upon opening one and connecting it to the computer theirs also shows 45 MB of unallocated space at the beginning of the drive as well.
That indicates that it’s probably done like this at the factory and not just mine has this configuration.
I am concerned about what is stored there; and is it possibly executable, etc.. especially with seeing the hexdump strings of text above from within the 45 MB of “unallocated space.” If it is executable; I would assume perhaps it is accessible when booting to the drive.
Anyone seen this before? Any explanation you can think of?
EDIT: When I called the company that makes it they also plugged in a 128GB size of the same model line and the unallocated space was 31 MB. Not sure if that has any bearing on what might be going on here, but it's certainly not “proportional” or at the very least the same.
EDIT: I have subsequently tried another brand new unit (same model, batch number, size (64GB) drives. As displayed by GParted:
Drive #1: 45.33 MiB Unallocated and 58.89GB FAT32
Drive #2: 46.38 MiB Unallocated and 54.70GB FAT32
These are both supposed to be 64GB drives. Identical in size, etc. This is straight from the factory. I have never encountered this kind of discrepancy with other flash drives. I mean, that’s over 4GB less of storage space between the two drives in total sector size.
As displayed by "fdisk -l" as requested (for the #2 drive only since I already cleared out the partition table of drive #1):
Disk /dev/sdc: 58.8 GB, 58787364864 bytes
90 heads, 26 sectors/track, 49067 cylinders, total 114819072 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x75cbf5af
Device Boot: /dev/sdb1
Start: 94976
End: 114819071
Blocks: 57362048
Id: c
System: W95 FAT32 (LBA)
Also, this doesn't explain why there is 45MB or 46MB of unallocated space prior to the first partition, but for 2 identical 64GB drives when I run a "dd if=/dev/sdb of=/flash_drive_dd.img bs=1M" command (which should give me an indication of the entire storage capacity of the drive right?) I get two completely different numbers:
Drive #1 displays 63,283,658,752 file size
Drive #2 displays 58,787,364,864 file size
Those values are for the full drive... not just a partition of supposedly identical model 64GB drives.
Regarding the possibly related drastically different sector count on two identical devices (Perhaps this should be a different question post?) Is Overprovisioning possibly occurring ---> In light of realizing that two idential 64GB drives show wildly different available sector sizes (one coming nowhere near close to 64,000,000,000 MB) Does that mean one is overprovisioning or something while the other isn't?
The way I figure out what I should see in my OS is the following: I take 64,000,000,000 bytes and divide by 1024 ^ 3 and I SHOULD get 59.6 GB being reported by the OS (or very close).
Even if there is some "overprovisioning" (is there such a thing for USB flash drives like for SSD) at least I would expect that to be consistent and not wildly different sizes between two identical model drives.
But, fresh out of the box:
Drive #1 only has 63,283,658,752 sectors for the entire device which is 58.9G. If I've done my math correctly; I'm missing over 700 MB for this drive.
And
Drive #2 only has 58,787,364,864 which is 54.8G And again, if I've done my math correctly, I'm missing 5.2 GB for the second drive.
That's disconcerting.... identical models with WAY less space (for the entire drive) than I would expect... the second drive being way less in size than the other.
Even it was overprovisioning of some sort; I would think it should be consistent no?
That doesn't even explain the 45 or 46 MB worth of unallocated space at the beginning with seemingly executable data.
Things keep getting weirder and weirder unless I'm missing something fundamental about USB flash drives.
Sorry this is a little long... I keep discovering more things and adding as I go forward.
3The strings (or rather the files that contained them) may simply be part of an automated test system that checks the drive for errors before releasing it to shipping. – Daniel B – 2015-03-20T23:23:55.693
1
Some of those strings (e.g.
– bwDraco – 2015-03-20T23:33:14.787An application has made an attempt to load the C runtime library incorrectly
) are part of MSVCRT. Apparently, the runtime library is statically linked to whatever executable was present there. Earlier strings, such as"Invalid partition table. Error loading operating system.
are part of the Windows MBR/bootloader.A
strings
search of the entire drive is meaningless; you will have to show the partition table so we can see what you are talking about: i.e.fdisk -l
. – psusi – 2015-03-21T01:36:10.570What is the brand and model of drive in question? With all the details you are providing you seem to have skipped this one critical piece of info. Also, why not just reparation and reformat the disk before using? – JakeGould – 2015-03-21T04:51:51.363
Silicon Power Marvel M70 64GB. I usually do a ton of research when purchasing products and have leaned towards this brand for a number of reasons and their very high reputation especially based on the Silicon Power A80 external drive. I could simply repartition; but I'd like to know the reason or likely reason to have a bunch of hidden data on a drive and does that potentially indicate any other security concerns. And now with new analysis of a second identical model that is 4,496,293,888 (4.5 Gigs) of less total blocks available on the device. Easy explanation or concerning? – mike2000 – 2015-03-21T06:07:08.717
In any case, you can run
shred -n 1 -v /dev/sdX
on it to "shred" it (overwrite everything with random data, including that unallocated space) and then usefdisk
to recreate a new partition on it, and finally reboot back in Windows to format that partition to whatever filesystem you want to use. – None – 2015-03-21T06:17:29.393@mike2000 I edited your question, but you generally should always add details like that to your question and not in the comments. Comments are not really read or easily viewed; the question is where details like this are critical. – JakeGould – 2015-03-21T06:24:59.933