Counterfeit PNY Elite-X 128GB SD Card

Today we got a counterfeited PNY Elite-X 128GB SD in for data recovery. When we read the card it showed as 128GB filled with 0xFF’s. At first we thought maybe the FTL (Flash Translation Layer) was corrupted and that by opening the card up and reading the physical raw memory chip we could recover the data.

Sometimes when a card fails its FTL, which maps physical to logical sectors in flash memory (ie: LBA0 is in page 1234), becomes corrupt and you’ll see a test pattern or 0xFF’s.  We can usually rebuild the FTL and recover most of the data.

In this case we were greeted by a generic unbranded MicroSD card in an SD to MicroSD adapter, which is never a good sign. We frequently see this in counterfeit media cards (eg: SanDisk). The case and sticker will look convincingly authentic, but the physical capacity of the MicroSD card is a fraction of the advertised capacity.

Typically, what happens is the card will function until the physical capacity of the MicroSD is reached at which point the card fails or occasionally will continue to work but not write any information to the card.

Proceeding with the case, we isolated all the signals on the MicroSD’s circuit board and discovered it was using a memory chip with an ID: AD DE 14 A7 42 4A. When we looked it up, the chip was actually a Hynix 8GB flash memory chip. Not 128GB as advertised on the SD card’s sticker.

We connected the 8GB MicroSD to our flash memory reader and discovered one of the chip’s planes was damaged and not being used meaning in addition to the card having a lower-capacity memory chip, the MicroSD card was also refurbished and was only using half its capacity (4GB). So, a counterfeited 128GB PNY Elite-X SD Card with a counterfeited 8GB MicroSD.

After dumping the physical memory chip, removing bad bit columns, decrypting the XOR and manually reassembling the image, we were surprised to find actual pictures on the card. Unfortunately, all the pictures were old; none of the pictures from the current day’s photoshoot were on the card, so it wasn’t a successful recovery.

The label and quality of the card were very convincing; it wasn’t until we worked on the card that we realized it was fake. The plastic felt right; the label was convincing. Overall, it’s a little scary how good these fakes look. In years prior, fake cards always looked a little off. Instead of SanDisk the label would say SanDisc or the font would be entirely wrong.

What makes these counterfeit cards especially dangerous is how quietly they fail. Because the card reports the full 128GB to your device, your phone or camera will happily keep writing past the real 8GB (in this case only 4GB) of physical memory. Everything looks fine on the screen, but the moment you exceed the true capacity the card either silently drops new files or starts overwriting data you’ve already saved. You usually don’t find out until you go looking for photos that were never actually stored.

If you’ve bought a card you’re unsure about, you can catch most fakes before you trust them with anything important. A free tool like H2testw on Windows or F3 on Mac and Linux writes data across the entire advertised capacity and then reads it back, so a card claiming 128GB but holding only 8GB will fail verification almost immediately. It’s worth running on any new high-capacity card, especially anything bought from a marketplace seller, before you take it on a trip or a shoot.

If you’ve already lost photos or files to a card like this, stop using it. Every additional write reduces the chance of recovering what’s left. Counterfeit cards are sometimes recoverable, as this one partly was, but it takes chip-level work to dump the real memory and reassemble the image. If the data matters, power the card down and have it looked at rather than running consumer recovery software against a card that’s lying about its own layout.

Most fake media we see comes from third-party Amazon sellers. If you’re going to buy media from Amazon, make sure it’s from the manufacturer’s store, also comparatively if the deal looks too good, it’s probably counterfeit.