Linux command
f3probe 命令
安全
权限或系统影响较大，执行前请核对目标。
常用示例
Probe a flash drive
sudo f3probe --destructive [/dev/sdX]
Probe with timing information
sudo f3probe --destructive --time-ops [/dev/sdX]
Probe with minimal memory usage
sudo f3probe --destructive --min-memory [/dev/sdX]
Probe without restoring data
sudo f3probe --destructive -n [/dev/sdX]
Force a specific block size
sudo f3probe --destructive --block-order=[9] [/dev/sdX]
说明
f3probe is part of the F3 (Fight Flash Fraud) suite and detects counterfeit flash memory devices such as USB drives and SD cards that report false storage capacities. Many fake drives claim large sizes (e.g., 256GB) but contain only a fraction of that memory, causing data loss when the actual capacity is exceeded. The tool works by writing unique sequential patterns from the end of the reported capacity backwards. When readback fails due to non-existent flash cells, it identifies the actual usable capacity. f3probe operates directly on the unmounted block device and requires root privileges. If a fake drive is detected, f3probe reports the fake type and real memory size. The output can be used with f3fix to create a partition that fits the actual size of the drive.
参数
- -b, --block-order=_ORDER_
- Force block size of the drive to 2^ORDER bytes.
- -l, --min-memory
- Trade speed for less memory usage.
- -n, --destructive
- Do not restore blocks after probing (faster but data is lost).
- -s, --reset-type=_TYPE_
- Reset method to use during the probe.
- -t, --time-ops
- Time reads, writes, and resets for diagnostic output.
- -?, --help
- Display help message.
- -V, --version
- Print program version.
FAQ
What is the f3probe command used for?
f3probe is part of the F3 (Fight Flash Fraud) suite and detects counterfeit flash memory devices such as USB drives and SD cards that report false storage capacities. Many fake drives claim large sizes (e.g., 256GB) but contain only a fraction of that memory, causing data loss when the actual capacity is exceeded. The tool works by writing unique sequential patterns from the end of the reported capacity backwards. When readback fails due to non-existent flash cells, it identifies the actual usable capacity. f3probe operates directly on the unmounted block device and requires root privileges. If a fake drive is detected, f3probe reports the fake type and real memory size. The output can be used with f3fix to create a partition that fits the actual size of the drive.
How do I run a basic f3probe example?
Run `sudo f3probe --destructive [/dev/sdX]` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -b, --block-order=_ORDER_ do in f3probe?
Force block size of the drive to 2^ORDER bytes.