For the mode’s normal behaviour, read our explainer on FakeFlashTest Test Empty Space first; for how to interpret results generally, see how to read FakeFlashTest results. The tool is obtained via the download page, and it must be run as administrator or it will not list your drive.

What Test Empty Space errors mean

Recall how the mode works: it writes test files only into the drive’s free space and reads them back, verifying at intervals as it fills — checks at points such as 3, 5, 9, and 17 GB rather than only at the end. An error means a test file that was written into free space could not be read back correctly. The drive failed to store, in its supposedly empty region, data it accepted minutes earlier.

On a fake drive, that failure has a precise implication: cumulative writes have reached, or the free-space writes have crossed, the boundary of the real chip, and the controller’s wrap-around behaviour has begun overwriting data — starting with whatever occupies the oldest addresses, which may include your test files and may include the early parts of the volume where your existing files live. On a genuine but ageing drive, the same symptom can instead indicate failing flash in the free region. Either way, the meaning is not “the test glitched.” It is “this drive did not reliably store data in the space it claimed was free,” which is exactly the question the test exists to ask.

Why files already on the drive can be corrupted

Test Empty Space is designed to preserve existing files: it writes only where the file system reports free space. That design is real, and on a genuine drive it holds. The exception is built into what a fake is. Files already on a fake drive may sit, wholly or partly, in bad areas — regions beyond the real capacity, where their contents were already wrapped, overwritten, or stored only as directory entries pointing at reused space. Such files were not protected by any test mode, because the damage mechanism is the drive’s own firmware, operating whenever writes occur, including the ordinary writes you did before any test.

This is why the guidance attached to this mode has always been “designed to preserve — but back up first.” The backup is not a formality. It is the only protection that survives the scenario where the drive’s free-space errors turn out to be the visible edge of corruption already present in your data. If you ran the test without a backup and got errors, your next action is not another test; it is the salvage in the next section.

Immediate steps after errors: protect first, test later

Stop writing to the drive. Do not save anything further to it, do not reorganise its folders, and do not re-run any test yet. Copy its existing files to your computer — copies, verified by opening them on the computer afterwards — prioritising irreplaceable files and, among them, the most recent, which are the likeliest to have survived intact if wrap-around is the cause. Work through the drive methodically and note which files verify clean and which are corrupt; that inventory is the truth about what the drive has done to your data, and no subsequent test result will improve it.

If important files are among the corrupt or missing, keep expectations honest about recovery: software can sometimes recover deleted or formatted files that have not been overwritten, but data overwritten by wrap-around is gone in substance. Our guide on what to do next after a fake is confirmed covers that salvage-and-recovery sequence in full. Only when the data is as safe as it can be made should you think about verdicts and refunds.

Getting a cleaner verdict: empty drive, Quick test

Test Empty Space, by construction, only ever tests the free portion of a drive, and its errors leave room for argument about occupied regions. Once your files are safely copied off, remove that ambiguity: with the drive empty (or content to lose its contents), run the Quick Size Test, which samples the entire reported capacity with its marker blocks, including the far end where fakes are most exposed. That complete, clean run is the verdict to screenshot and to use as evidence — a full-capacity result, on an empty drive, on a known setup.

Screenshot the Quick result log and proceed as with any confirmed fake: stop trusting the drive, claim via the platform with real-versus-advertised capacity documented, and replace through a genuine channel. If, contrary to expectations, the emptied drive passes the Quick test cleanly and the earlier errors were confined to a troubled free region of an otherwise genuine drive, you still own a drive that produced storage errors — retire it from important duty regardless. Errors are information either way. Protect the files first, then let the clean test on the empty drive, using the tool from the download page, have the final word, clearly and on the record.

To be clear about roles first: FakeFlashTest only diagnoses; it does not repair. If you have not yet confirmed the drive is fake, run the test via our capacity testing guide with the tool from the download page, and if the verdict is confirmed, read Fake Drive Confirmed: What to Do Next for the safer sequence — refund and replacement come before tinkering in any sensible order.

Step one of any attempt: identify the controller with ChipGenius

A fake drive is not reprogrammed generically; it is reprogrammed with a tool matched to its specific controller chip. So the first step in every tutorial on this subject is identification. ChipGenius is the usual utility: it reads and displays the drive’s controller details — vendor and product identifiers (VID/PID) and controller/NAND information — without testing capacity itself. ChipGenius does not test or fix anything; it tells you what is inside, which determines which, if any, mass-production tool even applies to your drive.

Record what it reports carefully. The same outward drive can contain different controllers across production runs, so guides based on “the same model” may describe a different chip from yours. If identification is ambiguous, that ambiguity is itself a preview of the whole project: every subsequent step is controller-specific, version-specific, and unforgiving of near-misses.

The MPTool concept: factory tools that rewrite the lie

The reprogramming tools are called MPTools — mass-production tools. They are the factory utilities used to configure a controller in the first place: setting the reported capacity, formatting the flash, and writing the controller’s parameters. The fakes were made with exactly this class of tool, used to set a false capacity; in principle, the matching MPTool can set the true one, after which the drive reports only the capacity its chip really holds and behaves like a small, ordinary drive.

In principle is doing heavy lifting. The correct MPTool must match your controller and often its specific variant; the wrong tool can fail harmlessly or can brick the device outright, leaving it undetectable by any computer. The developer’s own tutorials in this area reflect the era these tools come from — procedures referencing XP-era tooling and environments are normal in this world, which means compatibility battles on a modern Windows PC before you ever reach the reprogramming step. Nothing about the route is a consumer feature. It is factory-floor software, leaked into hobbyist circulation, with factory-floor assumptions about the operator.

The risk nobody can remove: reject NAND

Suppose everything goes right: correct identification, correct MPTool, successful reprogramming, drive now truthfully reporting its small real capacity. The deepest problem remains untouched. Fakes are built down to a price, and the flash inside them is frequently reject-grade NAND — chips that failed quality standards for legitimate products, with weak endurance, marginal cells, and failure behaviour that no controller setting can improve. The firmware lied about capacity; the silicon itself is also the industry’s leftovers.

That is why the honest guidance, consistent with the developer’s own caution, is that even a successfully “fixed” fake should not be trusted with important data. It might work, at its true size, for a long time. It might also corrupt files next month for reasons unrelated to capacity — a marginal chip being a marginal chip. You would never know which outcome you were getting until the loss told you. Storage whose trustworthiness is unknowable is not storage; it is a gamble with a drive-shaped object.

Before you start: set the conditions for a safe experiment

If you do attempt the tinkering route, set the experiment up so failure costs nothing. Work only on a drive you have already been refunded for or written off, with no data on it that you need. Keep notes of the original ChipGenius readings and every tool version you try, so a failure is at least informative. Expect to spend real time hunting for the matching tool, and accept in advance that the drive may end the day undetectable — bricked by a mismatched tool is a known outcome, not bad luck. If any of those conditions would bother you, the experiment is telling you it is not worth starting.

The verdict: tinkering yes, reliance no

As a learning project, reprogramming a fake is genuinely interesting: ChipGenius identification, controller research, an MPTool session, and a formerly lying drive telling the truth at its real size is a satisfying afternoon for a technically curious person — on a drive they were refunded for, with nothing on it, accepting it may end bricked. As a storage strategy, it fails on economics as well as trust: the time involved exceeds the value of a small genuine drive, and the result is the least trustworthy small drive you own.

So the sequence this site recommends stands: confirm with FakeFlashTest from the download page, claim the refund with the test evidence, replace through a genuine channel, and test the replacement on arrival. If curiosity still itches afterwards, scratch it on the refunded fake as a science project — labelled, literally if you like, with its true capacity and a warning — and never let it graduate to holding the only copy of anything. Honesty about MPTools means admitting both halves: it can be done, and you should not depend on it.

If the drive is still partly visible or will not format, our companion guide on a USB drive that won’t format after testing covers the adjacent symptom. The testing guides themselves are the Quick Size Test guide and the main capacity testing guide, with the tool on the download page.

The developer’s explanation: writes to sectors that do not exist

A fake drive’s controller reports a large capacity backed by a small chip. Normal use, for a while, only touches real storage, and the hacked controller copes. A capacity test deliberately writes across the whole reported range, including sectors that do not exist in reality. Faced with sustained writes to non-existent addresses, the hacked controller can become confused, corrupt its own state, or stop responding to the computer altogether — the drive becomes unformattable, undetected, or both.

That is a consequence of the fraud, exposed by the test, not damage inflicted by a legitimate test on a legitimate product. The developer’s framing deserves repeating because it is the honest one: the same failure would have happened in normal use, later, the moment your ordinary files grew past the real capacity and the controller faced the same impossible writes. The only difference the test made is timing — it happened now, on an empty or backed-up drive, inside your return window, instead of months from now with your files inside the blast radius. A genuine drive does not die from having its advertised capacity written to; that is what advertised capacity means.

First checks: is it really gone?

Work through the visibility ladder calmly before concluding anything. Check File Explorer, obviously — but then open Disk Management, where a drive can be present as a device or volume even when Explorer shows nothing, for example because it lost its drive letter or its volume is damaged. If Disk Management shows the device with unallocated or raw space, it is not dead; it is a formatting and partitioning problem, and an empty drive in that state can be reinitialised — although, if it is a confirmed fake, read the verdict section below before investing effort. If Disk Management shows nothing, open Device Manager and look under disk drives, and try the physical checks next.

Those physical checks are quick and worth doing properly: a different port, directly on the computer rather than through a hub; for a card, a different reader; and ideally a second computer entirely. A second PC rules out your machine’s ports, drivers, and security software in one move, and a drive that appears there was never dead — it was a local visibility problem, and our guide on FakeFlashTest showing no drives covers that family of fixes.

If it is truly gone: a paperweight, and a claim

If no computer, port, or reader can see the device at all, accept the practical verdict: it is a paperweight. There is no software resurrection for a controller that no longer enumerates as a device, and a drive in this state held no trustworthy future anyway. Do not let the loss of the object distract you from the claim: a fake that dies under a capacity test is a counterfeit that failed in the most demonstrable way possible, and your evidence — the purchase record, the listing’s claimed capacity, your test screenshots and notes of what happened — supports a refund claim on exactly that basis.

Follow the evidence-based route in our guide on how to get a refund for a fake USB drive: dispute as counterfeit or falsified specifications through the platform, attach the documentation, and let the platform’s process handle any question of returning a dead item, rather than paying privately to ship it. Note clearly in the claim that the drive ceased to be detected during a standard capacity test, which is a documented behaviour of fake controllers, not misuse — testing a storage product’s stated capacity is a normal, reasonable use of it.

What about the files that were on it?

If the vanished drive held files, let the visibility checks finish before you grieve them. A drive that reappears on another computer may still hold readable data, and your priority then shifts immediately to copying — verified copies, newest and most irreplaceable files first, with no further testing until salvage is complete. A drive that remains invisible everywhere, on the other hand, offers nothing to salvage from, which is precisely why testing on arrival, while a drive is still empty, is the discipline this site keeps returning to. The disappearance is worst when it is also a data loss; on an empty new drive it is only a refund errand.

The lesson to keep

Every part of this outcome argues for the habit this site repeats: test on arrival, on an empty or backed-up drive, inside the return window. A fake that will die under testing will die under use; the only variable you control is whether it happens as a refundable event with no data at stake, or as a data-loss event later. If your drive disappeared, you have — despite the frustration — landed on the right side of that trade. Document it, claim it, replace it through a genuine channel, and test the replacement on day one with the tool from the download page. The next drive’s test will take five minutes, and this time a quiet, boring pass is exactly what you want.

For how the tests are supposed to run, see our Quick Size Test guide and the main routine in how to test a USB flash drive for fake capacity. The tool itself is available via the download page. Before assuming a hang, confirm the test was started correctly: drive connected directly, FakeFlashTest running as administrator (required, or drives are not listed properly), and the correct letter selected.

First, give it a fair chance: some tests are simply slow

The developer’s famous 27-second example involved a small fake drive, and it has set unrealistic expectations ever since. That was one small device; it was never a promise. A drive reporting a very large capacity gives the test a lot of ground to sample, and the sampling is done at the speed of the slowest link in the chain — the drive or card itself, the reader, and the port. A large claimed capacity moving through a slow interface can stretch a Quick test from seconds into a long wait, and Test Empty Space, which fills real space with real files, takes longer still by design.

Judge by progress, not by the clock. If numbers, percentages, or written amounts are advancing — however slowly — the test is working. Note the current progress value, check again after a real interval, and compare. Only a test whose progress has not moved at all across a long, patient interval deserves the word stuck. Interrupting a slow-but-moving test at minute ten teaches you nothing and costs you the whole run; many “hangs” are simply big drives being big.

Slow readers and laptop slots: the bottleneck may not be the drive

For SD and microSD cards especially, the reader is frequently the slowest component. Inexpensive readers and some built-in laptop card slots move data at a fraction of what a decent USB 3.0 reader achieves, and a test that would be brisk through a proper reader can crawl through a laptop slot. The same applies to USB hubs sharing bandwidth and power, and to front-panel ports with poor connections.

The practical response is to change the rig once, cleanly, rather than repeatedly restarting the test: move the card to a proper reader plugged directly into a main or rear port, close other programs hammering the same storage, and run the test again from the beginning. Our card guide, how to test a microSD card for fake capacity, treats the reader as part of the test setup for exactly this reason. If the same drive tests briskly in a better rig, you have found your hang — and it was never the drive.

When the drive itself struggles: controllers under sustained writes

There is a more meaningful cause, and it concerns fakes directly. A fake drive’s hacked controller manages a fiction under light use, but a capacity test subjects it to sustained writes across its whole claimed range — including addresses with no real storage behind them. Under that load, cheap controllers can slow to a crawl, stutter, disconnect, or crash outright. A test that progresses normally at first and then degrades badly around a particular region is behaving consistently with having reached the end of the real chip: everything beyond that point is the controller improvising.

Heat adds to this. Small sticks and cards under sustained writing can get warm and throttle, and a device crammed against other hot hardware or used on a soft surface that insulates it will fare worse. Let the device cool, give it air, use a short extension or a rear port to move it away from heat sources if it runs hot, and retry when cool — not as folklore, but because sustained-write performance on cheap flash genuinely degrades with temperature.

What to do if it truly never finishes

If progress has genuinely not moved across a long interval — and you have confirmed the rig is not the bottleneck — stop the test cleanly where you can, safely remove the device, let it cool completely, and retry once on a different port or computer if one is available. A device that repeatedly stalls a test at roughly the same region, on different setups, is giving you a repeatable result even without a formal log line: it cannot handle sustained writes across its claimed capacity, which is precisely the behaviour of a fake or a failing device. Screenshot whatever the tool shows, note the reported capacity and where it stalled, and treat the drive as untrusted.

Do not keep a drive in service because its test “never quite finished, so it never quite failed.” An unfinished test on a bargain high-capacity drive is not a pass; it is an unanswered question with worrying body language. Either obtain a completed verdict — better rig, cooled device, clean rerun with the tool from the download page — or replace the drive through a genuine channel. And if the unfinished business is a drive that now will not format or has vanished entirely, those are separate symptoms with their own guides, linked from our troubleshooting family. Patience first, rig second, verdict third: that order resolves almost every “stuck” test honestly.

For the testing context itself, see our guides to the two modes — the Quick Size Test and Test Empty Space — and for the closely related symptom of a drive vanishing altogether, our guide on a USB drive that disappeared after a test. The tool itself is on the download page.

Why fakes live on FAT32 — and struggle with NTFS

The developer’s explanation starts with how the two file systems lay out their structures. A fake drive’s controller reports a large capacity while a small chip provides the real storage. FAT32 keeps its essential structures relatively compact and toward the start of the volume, so a fake can be formatted FAT32 and appear to work: Windows writes the structures where real storage exists, and casual use stays plausible for a while.

NTFS is less forgiving of the lie. It places its directory around the 3 GB mark and keeps a backup sector at the very end of the partition. On a fake, that end-of-partition location may not exist as real storage at all, and the directory placement probes regions the controller is faking. The result can be a format that fails, stalls, or completes into a volume that immediately misbehaves. This is exactly why fakes are usually sold formatted FAT32, and why a drive that flatly refuses an NTFS format while claiming a huge capacity is showing you evidence about itself. The file system did not break the drive; it asked questions the drive could not answer honestly.

The innocent case: Windows will not offer FAT32 above 32 GB

Separate from fakes entirely, Windows has a long-standing dialog quirk: its built-in format window will not offer FAT32 for volumes larger than 32 GB, even though FAT32 itself can support much larger volumes and Windows will happily use a large FAT32 volume formatted another way. Users testing a genuinely large drive, wiping it after a destructive Quick Size Test, regularly meet this and assume something is broken. Nothing is: choose NTFS or exFAT in the Windows dialog for a large genuine drive, or use a tool that can format large FAT32 volumes if FAT32 is genuinely required for a device’s compatibility.

That tool, in this tool’s own family, is RMPrepUSB — the developer’s main program, from the same author as FakeFlashTest. RMPrepUSB can format large volumes as FAT32 where the Windows dialog will not. If your need is a big FAT32 volume for a camera, console, or older device, that is the practical route. Keep the distinction straight, though: “Windows will not offer the option” is a dialog limit; “the format itself fails partway with errors” is a drive talking, and on a high-capacity bargain drive it is usually confessing.

What to try, in a sensible order

First, retry the format in Disk Management rather than Explorer, deleting the existing volume and recreating a simple volume at full size — and if the drive’s contents matter, stop: formatting is destructive, and everything here assumes an empty or backed-up drive whose test is complete. Second, match the file system to the purpose: NTFS or exFAT for a large genuine drive in Windows use; FAT32 via RMPrepUSB only when a target device truly needs FAT32. Third, observe where a failure happens. A format that errors when writing structures near the end of a huge claimed capacity, on a drive that also failed its capacity test, is one story told twice.

Try the drive on another port and, if available, another computer before declaring it dead; a reader or port fault can masquerade as a format failure just as it can hide a drive from testing tools. But do not loop endlessly through format attempts on a confirmed fake, expecting a combination of settings to succeed. No file system choice repairs missing hardware.

The verdict underneath: a fake is still a fake

Here is the sentence to keep hold of: successfully formatting a fake drive — even coaxing it into a working FAT32 volume sized to its claim — does not make it genuine. The real capacity is the chip, not the format. Such a drive will still wrap around and overwrite older files once writes pass its real limit, and the format’s success merely restarts the clock on that discovery. If FakeFlashTest has shown the capacity to be false, the drive’s future is a refund claim with the test log as evidence, not a formatting project.

Conversely, a genuine drive that hit only the 32 GB dialog limit, or needed its volume recreated after a destructive test, is healthy — format it appropriately and use it with confidence. Telling those two situations apart is the whole skill: dialog limits and post-test repartitioning are normal; end-of-partition failures on a drive that failed its capacity test are a confession. When in doubt, retest cleanly with the tool from the download page rather than arguing with the format dialog — the capacity verdict settles what the format error means.

The starting point is source discipline: only ever obtain FakeFlashTest via our download page, which links to the official password-protected ZIP on the developer’s site, rmprepusb.com. Everything in this guide assumes that source. A copy of the tool from a random hosting site deserves every warning it gets, and no explanation here should be read as covering it.

Why the official ZIP has a password: fake

The official FakeFlashTest download is a password-protected ZIP, and the extraction password is fake. The developer set the password deliberately, to reduce false blocks by Windows Defender. The reasoning is mechanical: antivirus scanning cannot easily inspect the contents of a password-protected archive in transit, so a legitimate but unusual tool is less likely to be blocked mid-download or quarantined on arrival purely for containing a low-level disk utility. The password is printed openly by the developer — it is a packaging choice against false alarms, not a secret and not a paywall.

That openness matters for your own judgement. A password the developer publishes on his own site, for a reason he states, on the package his own download page serves, is a documented fact about the official distribution. A password demanded by an unofficial repack you found elsewhere, with no explanation, is a different thing entirely — and one more reason the official route via the download page is the only route this site recommends.

Why low-level tools trigger false positives

FakeFlashTest writes marker blocks across a drive at a low level and needs administrator rights to enumerate USB storage. Those are legitimate behaviours for a capacity-testing tool — they are the job. But they resemble, at a glance, behaviours that malicious software also uses: low-level disk access, administrator elevation, writing outside ordinary files. Heuristic protection is pattern-matching under uncertainty, and small, unsigned, infrequently downloaded utilities written by individual developers are exactly the files heuristics judge most harshly. A false positive — a warning about a genuine tool — is a known cost of that system, for this whole category of software.

Understanding that cuts both ways, and the honest reading matters: a Defender objection is not proof a file is malicious, and it is also not proof a file is safe. It is a prompt to verify, which is something you can actually do with this tool, because its identity can be checked objectively rather than argued about.

Verify the file: check the SHA-256 hash

Verification means comparing the file you have against the file the developer published, using its SHA-256 fingerprint. Our download page records the verified details for the official v1.1.5 package and the executable inside it, established by downloading from the developer and hashing the files. After extracting (password fake), open PowerShell in the folder containing the extracted executable, run Get-FileHash followed by the file’s name, and compare the long hexadecimal result character for character with the published value.

If the hashes match, the file on your disk is bit-for-bit the file that was verified — no repack, no tampering in transit. If they do not match, stop: delete what you downloaded, and fetch it again only through the official link. Hash verification is the strongest answer available to “should I trust this file?”, and it is available precisely because you used the documented source. It converts a judgement call about warnings into a check with a yes-or-no outcome.

What we will never tell you to do

This site will never instruct you to disable Windows Defender, turn off your antivirus, or click Run Anyway past a warning as a routine step. Those instructions are a staple of genuinely malicious downloads, and a testing tool does not need them when it is obtained properly and verified by hash. If a warning appears for the official, hash-verified file, the safe responses are the boring ones: confirm the source, confirm the hash, update your security software’s definitions (false positives are routinely corrected), and, if your environment still will not cooperate, run the tool in Safe Mode as described in our troubleshooting guides or test on another machine — rather than stripping the protection off your main system.

If warnings are paired with tests failing on every drive, follow our guide on the Quick Size Test failing every drive before blaming any single drive. Relatedly, be alert to impostors trading on this exact story. Because “the antivirus warning is a false positive, disable it” is a sentence real scammers use, any site that urges you to lower your defences to obtain FakeFlashTest — especially a site that is not the developer’s — should end the conversation. The genuine developer’s approach is the opposite: a published password to reduce false blocks, a verifiable file, and no request that you weaken your PC.

The calm summary

Password-protected official ZIP (password fake), set by the developer to reduce Defender false blocks. Low-level tools attract heuristic warnings; that is a prompt to verify, not to panic or to comply blindly. Verify with Get-FileHash against the values on the download page, keep your protection on, and use Safe Mode or another PC if your setup still objects. Do that, and the warning becomes what it should be: a checkpoint you passed with evidence, on your way to testing drives with a tool you have proven is genuine. From there, our guide on how to test a USB flash drive for fake capacity takes over.

This is not guesswork. The developer of FakeFlashTest addresses this exact pattern: if the Quick Size Test fails every drive, security software or a driver is likely interfering with the tool, and the advised solution is to run FakeFlashTest in Windows Safe Mode. This guide explains why that works, how to do it, and how to confirm the diagnosis. Keep the genuine tool handy via our download page, and keep our Quick Size Test guide open for how the test should behave normally.

Why security software and drivers can break the test

The Quick Size Test does low-level work: it writes 512-byte marker blocks at intervals across a drive and reads them back, starting from the end of the reported capacity. Tools that operate at that level look, to protective software, similar to things protective software exists to stop. A security program or a storage-related driver that intercepts, delays, or blocks those operations can corrupt the test’s view of the drive — writes that never landed, reads that were mediated — producing failures that describe the interference, not the drive.

The tell is the pattern. Interference does not care which drive is inserted, so it fails genuine drives and fake drives with equal enthusiasm, often quickly and in similar ways. A single fake, by contrast, fails on its own merits while known-good drives tested on the same setup pass. Before you conclude anything about a batch of drives, test one drive you trust completely — a genuine drive from a reputable purchase that has been in reliable service. If that drive fails too, stop condemning drives and fix the test environment.

The Safe Mode fix, step by step

Safe Mode starts Windows with a minimal set of drivers and services. The security software and third-party drivers that interfere with low-level testing are, by design, not loaded — which is exactly the environment the developer advises for a clean run. On Windows 10 and 11, the standard route is: hold Shift while clicking Restart from the Start menu; in the recovery screens that follow, choose Troubleshoot, then Advanced options, then Startup Settings, then Restart; when the list appears, press the key for Safe Mode (plain Safe Mode is sufficient — you do not need networking for a local test, and networking adds back components you are trying to exclude).

Once in Safe Mode, the desktop will look stark and low-resolution; that is normal. Plug in the drive directly, confirm Windows assigns it a letter, and run FakeFlashTest as administrator — the administrator requirement from our guide on FakeFlashTest showing no drives still applies in Safe Mode. Select the correct drive letter with the usual care (the Quick test is destructive; the drive should be empty or backed up) and run the Quick Size Test. Then restart normally when you are done; Safe Mode is a one-boot diagnostic environment, not a state your PC stays in.

How to confirm the diagnosis

Run two tests in Safe Mode if you can: the known-good drive first, then the suspect drive. There are three informative outcomes. If the known-good drive now passes, the interference diagnosis is confirmed — your normal Windows environment was corrupting the tests, and every fail recorded there should be discarded and retested. If the suspect drive then also passes in Safe Mode, it was a victim of the same interference; treat it as unproven rather than fake, and consider a full test for confidence. If the suspect drive still fails in Safe Mode while the known-good drive passes, the failure is travelling with the drive, not the PC — that is a genuine verdict you can act on, with the log as evidence.

Back in normal Windows, you can optionally identify the interfering component by elimination — pausing individual security tools’ real-time features within their own settings, one at a time, and retesting the known-good drive — but you never need to solve that mystery to get a trustworthy result. Safe Mode already gives you one. Never respond to interference by permanently disabling your security protection for everyday use; the diagnostic mode exists precisely so you do not have to.

What not to conclude, and what to do next

Do not conclude that several drives bought from different places all turned out fake simultaneously — simultaneous universal failure is the signature of a local cause. Do not return a drive as counterfeit on the basis of a test run in an environment where a known-good drive also fails; that evidence would not hold up, and it is not fair to the claim. And do not keep re-running the same test in the same environment expecting a different pattern; interference is consistent until the environment changes.

Instead: Safe Mode, known-good drive as control, suspect drive as test, logs screenshotted. A fail that survives a clean environment is a result you can trust and use. The tools and guides are all linked from the download page hub — and with the control-drive habit built in, you will never again mistake a grumpy driver for a drawer full of fakes.

Make sure you are using the genuine tool from the official source via our download page (extraction password fake for the official ZIP). If the drive eventually appears and tests fine, our guide on how to test a USB flash drive for fake capacity covers the full testing routine to follow next.

Fix 1: Run as Administrator — the developer’s own requirement

This is the fix, most of the time. FakeFlashTest’s developer states it plainly: the program must be Run as Administrator, or it will not list USB drives. The tool needs low-level access to removable storage that Windows does not grant to a standard launch, and without that access its drive list stays empty even though the drive is sitting right there in File Explorer.

Close the program completely, right-click its icon, and choose Run as Administrator, accepting the Windows prompt. Reopen the list and your drive should appear. If you plan to test regularly, this is the habit to build: administrator launch first, troubleshooting second. Do not reinstall, re-download, or suspect the drive until this step has been done — it is remarkable how many “the tool doesn’t work” reports end exactly here.

Fix 2: Make sure Windows gives the drive a letter

FakeFlashTest addresses drives by the drive letter Windows assigns, so a device that Windows itself has not mounted with a letter cannot appear. Open Disk Management (right-click the Start button and choose it) and find the drive or card there. If the volume is present but has no letter, right-click it, choose Change Drive Letter and Paths, and assign an unused letter.

Watch out for letter collisions: a card reader presenting several slots, or a network drive already holding the letter the USB device would naturally take, can leave the device letterless. Assigning a fresh letter manually resolves it. Once Windows Explorer shows the drive with its new letter, relaunch FakeFlashTest as administrator and check again.

Fix 3: Deal with unallocated or unformatted space

A brand-new, wiped, or damaged drive may appear in Disk Management as unallocated space with no volume at all — and therefore no letter for any tool to list. If the drive is empty or fully backed up, create a simple volume in Disk Management and format it (FAT32 is what fakes typically arrive as; the format you choose for a test on an empty drive is not important to the verdict). Then relaunch the tool as administrator.

If the drive holds data you need, do not create volumes or format over it to make it visible — that path sacrifices the data for the listing. In that case, work through the other fixes first, and check the device on another computer if you have one. Visibility problems caused by a damaged file system on a data-bearing drive deserve salvage thinking first, testing second.

Fix 4: Try another port — and respect the reader caveat

USB ports and connections are a mundane but real cause. Move the drive to a different port, preferably directly on the computer — a rear port on a desktop — and avoid testing through a USB hub, which can underpower devices or drop connections in ways that make tools see nothing. Relaunch as administrator after reconnecting, so the tool enumerates devices fresh.

For microSD and SD cards there is an extra link in the chain: the card reader. A faulty, loose, or extremely cheap reader can fail to present the card to Windows at all, and some multi-slot readers behave oddly with certain cards. If a card does not show up, try the card in a different known-good reader (or the same reader on another port) before concluding anything about the card. Our card-specific guidance in how to test a microSD card for fake capacity covers reader choice in more detail, because for cards the reader is part of the test rig.

Fix 5: Confirm Windows itself can see the device

Step back and check the basics in order: does the drive appear in File Explorer? In Disk Management, even without a letter? In Device Manager under disk drives? Each “yes” narrows the problem: visible in Windows but not in FakeFlashTest points back at the administrator launch; visible in Disk Management but not Explorer points at the letter; invisible everywhere points at hardware — port, reader, cable, or a genuinely dead device.

One more ordinary check is worth ten seconds before you move on: remove and reinsert the drive firmly, and if it is a card, reseat it in its adapter and reader as well. A shallow insertion or a tired adapter contact can leave a perfectly healthy card electrically half-connected — visible to nothing, not because the card failed, but because the connection never fully happened. Reseating costs nothing and resolves a surprising share of these cases.

A drive that no computer can see at all may be a fake that has already failed, which is its own scenario with its own next steps. And if the tool lists drives but tests misbehave on all of them, that is a different symptom again, pointing at software interference rather than visibility. Get the drive listed first, run the test from the download page version of the tool, and let one fix at a time prove itself — starting, almost always, with Run as Administrator.

If you have landed here without a confirmed result, run the test first using our guide on how to test a USB flash drive for fake capacity and the tool from the download page, and read our explainer on how to read FakeFlashTest results so the failure is documented before you act. If the failure is confirmed and screenshotted, start at Step 1 — in order.

1. Stop writing to the drive immediately

Every further write to a fake drive risks overwriting more of what is already there, because writes past the real capacity wrap around onto earlier data. So stop: no more copying to it, no “let me just add this one file,” no using it as temporary storage while you sort things out. Safely eject it if you are not actively salvaging from it in Step 2.

Resist two tempting experiments. Do not reformat it “to see if it helps” — formatting will not restore capacity that never existed, and it destroys structure that salvage might have used. And do not re-run destructive tests for curiosity. You have your verdict and your screenshot. From here, the drive is evidence and a salvage source, nothing more.

2. Salvage what still opens — copies first, newest first

If the fake held real files, salvage methodically. Work from the drive to a folder on your computer — copies only, never moving or editing in place. Prioritise in this order: first, the files you cannot replace and have no other copy of; within those, start with the most recently written files, because they are the likeliest survivors. Wrap-around overwrites the oldest data first, so recent files often sit within the real portion of the chip and open perfectly, while older files are the most likely to be corrupt.

Verify as you go: open each salvaged file on the computer, not from the drive, and check it properly — play videos through, open photos at full size, open documents beyond the first page. A file that copies without error can still be corrupt inside. Keep a simple list of what verified clean and what did not; that list shapes Step 3, and it prevents the false comfort of a folder that merely looks complete. Work steadily and do not interleave salvage with any writing to the fake — reading is what you want, writing is what endangers the rest.

3. Consider recovery software — with honest expectations

Set expectations correctly before spending hope or money. Data-recovery software offers a chance — only a chance — to recover deleted or formatted files that have not been overwritten. On a fake drive, the central damage is overwriting: bytes replaced by later writes are gone, and no software can reconstruct data that no longer exists on the chip. Recovery tools cannot un-wrap the wrap-around.

Where recovery can legitimately help is the margins: files that were deleted but whose space was never reused, or a file system damaged while the underlying data in the real-capacity region remains intact. If your salvage in Step 2 left important gaps, a reputable recovery tool such as EaseUS Data Recovery via /go/easeus-data-recovery is a reasonable attempt on the files that were lost by deletion or formatting — with results that will vary and cannot be promised. Scan the fake (or better, an image of it) and save anything recovered to your computer, never back to the fake itself. If a tool or service promises to definitely restore overwritten files from a fake drive, that promise is the second scam.

4. Claim your refund with the test evidence

With your data secured as far as possible, turn to the money. You hold the strongest refund position a buyer can have: a capacity test log showing the drive failing at a fraction of its advertised size. Follow the full evidence routine in our guide on how to get a refund for a fake USB drive — screenshot of the log plus the listing, dispute opened as counterfeit or falsified specifications on Amazon, eBay, or AliExpress as applicable, and the platform’s own process for any return shipping rather than paying privately at a seller’s request.

Do this promptly even if salvage took a day; windows close. Keep the drive until the claim resolves, in case the platform asks for anything further, but keep it out of service. A refunded fake you continue to use for “unimportant” files has a way of ending up holding an important file on a busy day.

5. Replace it with genuine storage — and back up properly

Buy the replacement through a genuine channel — the brand’s own store or an authorised retailer — accepting that real capacity costs real money, and test the new drive on arrival just as you tested this one. Then fix the underlying vulnerability this episode exposed: the fake hurt most if it held the only copy of anything. Keep copies so no single drive can take the only version of a file — the familiar 3-2-1 idea of multiple copies, on different media, with one copy elsewhere. A cloud backup via /go/pcloud is one straightforward way to hold that off-device copy, so a future hardware lie or failure is an inconvenience, not a loss.

Finally, what about keeping the fake itself, reprogrammed to its true size? Our honest treatment in Can You Fix a Fake USB Drive to Its Real Capacity? explains the MPTool route — and why, with reject-grade flash inside most fakes, a “fixed” fake should never be trusted with important data. Tinkering is fine; reliance is not. Stop, salvage, stay honest about recovery, claim with evidence, replace and back up: five steps, and the fake has cost you an afternoon instead of your files. Keep FakeFlashTest from the download page in your routine, and the next fake — if one reaches you — will be caught on day one.

If you can run a tool, do — it is faster and gives you a log you can use as evidence. Our main guide on how to test a USB flash drive for fake capacity covers the tool route, with the software itself on the download page. Use this manual method when a tool is genuinely not an option, or as a first sanity check while a download is still in progress.

The principle: fill past the lie, then verify

A fake drive’s controller reports a large capacity while hiding a small chip. Writes within the real capacity succeed genuinely. Writes beyond it wrap around and silently overwrite earlier data, while the folder listing continues to look normal. So a manual test must do two things, not one: fill the drive well beyond any plausible real capacity for a suspicious bargain — ideally toward its full claimed size — and then verify the earliest files, because those are the ones wrap-around destroys first.

Simply copying files until Windows says the drive is full, and seeing no error, proves nothing. The copying can report success throughout, because the controller accepts the writes and discards or overwrites quietly. Verification — opening, playing, or hashing the files afterwards — is the actual test. Skipping it is the mistake that lets fakes pass casual checks in shops and in early use.

Method 1: Fill with large known files

Choose source files that are large, known-good, and easy to verify: video files you can play, large photo collections, or disc images whose behaviour you know. Keep them on your computer as the reference copies — never move the originals, always copy. Fill the suspect drive in batches, noting roughly how much genuine data you have written at each stage, and note which files went on first.

When the drive is as full as you can reasonably make it, safely eject it, reconnect it (a fresh connection prevents cached views from misleading you), and then verify starting with the earliest files you copied. Play the first videos from the start and from near the end. Open the first photos at full size. If the earliest files are corrupt while the most recent ones play, you are looking at the wrap-around signature. If you have files with known checksums, or you recorded hashes before copying, compare the hashes of the copies on the drive against the originals — a mismatch is unambiguous, and hashing is the most rigorous manual check available. Even a sample of the earliest files, fully verified, tells you more than a folder listing ever will.

Method 2: The developer’s folder approach

The FakeFlashTest developer describes a simple manual variant based on folders of known content — organising the fill into clearly labelled folders (the idea appears in his material as TESTDIR folders of photos). The structure is the value: fill the drive folder by folder, each containing photos or files you can identify at a glance, in a known order. Afterwards, open the earliest folders and check the contents display correctly.

Ordered folders make the failure point visible. If the first several folders are corrupt but the last ones are fine, you have not only detected the fake — you have estimated its real capacity, from the amount of data that survived intact. Label folders by cumulative size as you go and that estimate becomes reasonably concrete, which is useful information for a refund conversation even without a tool log.

The honest limits of the manual method

First, it is slow. Filling a drive that claims a very large capacity with real files, at real USB speeds, can take a very long time — far longer than a sampling test, which is precisely why tools like FakeFlashTest exist. Its Quick Size Test, explained in our Quick Size Test guide, checks marker blocks at intervals across the whole claimed capacity instead of occupying all of it, reaching a verdict without a full fill.

Second, it is imprecise unless you hash. “The videos seemed to play” can miss corruption near the ends of files or in files you spot-checked too briefly. Third, a manual fill gives you no standardised log to attach to a marketplace dispute; screenshots of failed files help, but a tool’s result window stating real versus claimed capacity is cleaner evidence. Fourth, like any fill, it stresses a fake’s controller for a sustained period — acceptable on a new suspect drive you may return, another reason to do it before loading anything precious.

When manual is enough — and when it is not

A manual fill test is enough to answer a personal, low-stakes question: “is this bargain drive obviously fake?” If the earliest files corrupt, you have your answer, and you should stop writing, treat the drive as a fake, and pursue the refund route with whatever screenshots you can capture. If everything verifies after a genuinely full fill and thorough checking of the earliest data, the drive has survived a stronger test than most fakes can pass.

For high-capacity drives, for evidence you intend to submit, or whenever time matters, use the real tool instead — that is the recommendation, not a footnote. Download FakeFlashTest from the download page, run it as administrator, and let the marker blocks interrogate the whole claimed capacity in a fraction of the time a fill would take. The manual method’s real value is that it works anywhere, with nothing: a borrowed computer, no download, just files, patience, and the discipline to verify the first files, not the last.