Avian’s Blog

I recently bought a new USB flash drive. By chance I noticed that it didn't appear to be empty. The drive came pre-formatted with a VFAT file system that indeed did not contain any files when I took the drive out of the box. However the raw contents of the drive seemed to contain some data that was apparently written to it in the factory. Since I'm used to seeing just zeros or 0xff on new devices I was curious what was on it and whether it contains any hints on how these are tested in the factory.

This is the flash drive in question. It's an ADATA S102 Pro 32 GB flash drive.

usb 9-3.3: New USB device found, idVendor=125f, idProduct=312b, bcdDevice=11.00
usb 9-3.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 9-3.3: Product: ADATA USB Flash Drive
usb 9-3.3: Manufacturer: ADATA

This first thing I did was to dump an image of the drive in factory condition to a 32 GB file on my hard drive. I then used the binvis tool from Aldo Cortesi to visualize its contents.

The following picture shows just the first 32 MiB using the zig-zag curve. Beginning of the drive is in the top left corner. Offset increases from left to right and top to bottom:

There's mostly zeros in the first 16 MiB of the drive, with a few small isolated chunks of data and strings. At very the start there's the default partition table and the empty FAT. One of the other non-zero chunks has some recognizable strings referring to a burn-in test.

0101c000  41 44 41 54 41 20 55 46  44 20 20 08 00 00 00 00  |ADATA UFD  .....|
0101c010  00 00 00 00 00 00 56 5a  7e 33 00 00 00 00 00 00  |......VZ~3......|
0101c020  e5 73 00 74 00 20 00 66  00 69 00 0f 00 b5 6c 00  |.s.t. .f.i....l.|
0101c030  65 00 73 00 00 00 ff ff  ff ff 00 00 ff ff ff ff  |e.s.............|
0101c040  e5 42 00 75 00 72 00 6e  00 49 00 0f 00 b5 6e 00  |.B.u.r.n.I....n.|
0101c050  54 00 65 00 73 00 74 00  20 00 00 00 74 00 65 00  |T.e.s.t. ...t.e.|
0101c060  e5 55 52 4e 49 4e 7e 31  20 20 20 10 00 7b 83 be  |.URNIN~1   ..{..|
0101c070  74 52 74 52 00 00 84 be  74 52 03 00 00 40 00 00  |tRtR....tR...@..|
0101c080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Other than that I didn't find anything interesting. This seems to be just a remnant of some filesystem metadata. Chunks are too small to contain actual test code and I didn't expect that to be on the drive anyway.

Following the first 16 MiB is a pseudo-random pattern. It starts at offset 0x1024000 and repeats every 4 MiB (4194304 bytes). Extracting just a single repetition of the pattern and plotting it with binvis reveals that it has some internal structure to it. This plot is using the gradient color map and the same zig-zag curve as before:

I also played around with different ways of distributing the pattern onto a grid using matplotlib. This is how it looks like when drawn onto a 2048 by 2048 grid. The plot is zoomed into just one corner of the pattern:

I don't know the reason behind this pattern. It might just be some pseudo-random algorithm they are using and the values themselves don't matter. I don't recognize any obvious bit test patterns in it. It seems that on every 2048 byte line the byte values in the pattern increase using a different step. Histogram of byte values shows that all 256 values are represented approximately equally.

Interestingly, the test pattern does not continue throughout the entire 32 GB of the drive. It stops at approximately 3 GB. The drive just contains zeros after that. Does this mean that only the first 3 GB has been factory tested? Or maybe there was a bug in the process and only this first chunk didn't get zeroed out after the test while the rest of the drive did?