f3probe

Probe a block device

$ sudo f3probe [path/to/block_device]

$ sudo f3probe --min-memory [path/to/block_device]

$ sudo f3probe --time-ops [path/to/block_device]

f3probe [OPTIONS] <DEVICE>

-p, --percent
    Display progress as a percentage.

-r, --read-only
    Perform a read-only test. Safer for existing data but less effective for detecting fake capacity.

-e, --exit-if-corrupted
    Exit immediately if any data corruption is detected during the probe.

-h, --help
    Show a brief help message and exit.

-v, --verbose
    Enable verbose output, providing more details about the probing process.

-o, --output=FILE
    Redirect all standard output to the specified file.

-b, --block-size=SIZE
    Set the I/O block size (e.g., 512, 4K, 1M). Defaults to 1 MiB.

-s, --starting-offset=OFFSET
    Specify the offset (in bytes) from the beginning of the device where probing should start.

-l, --log-file=FILE
    Append probing log messages to the specified file.

-c, --count=COUNT
    Limit the number of blocks to test. Useful for quick checks on large devices.

-B, --bad-blocks=FILE
    Write a list of detected bad blocks to the specified file.

-f, --full-probe
    Force f3probe to write and read beyond the first 16 MiB, providing a more thorough probe. It still attempts to be non-destructive.

-a, --auto-probe
    Enable auto-probing, which might skip some extensive checks for faster execution.

f3probe is a command-line utility from the f3 (Fight Flash Fraud) project designed to quickly and non-destructively determine the true storage capacity and integrity of flash drives (USB sticks, SD cards, etc.). Counterfeit flash drives often report a much larger capacity than they physically possess. f3probe works by writing small amounts of data and immediately reading them back, comparing the written and read content. It carefully stores and restores original data to ensure the device's content remains intact. This makes it a fast and safe method for an initial assessment, unlike the more thorough but destructive f3write and f3read commands which fill and verify the entire drive. It helps users identify fraudulent devices before significant data loss occurs.

Requires root privileges to access raw block devices (e.g., /dev/sdX).
While designed to be non-destructive, any interruption (e.g., power loss) or system crash during the process could potentially leave the device in an inconsistent state. Always back up critical data.
Probing can still take a significant amount of time for very large devices, although generally faster than f3write/f3read.
Primarily detects capacity fraud; other types of flash drive issues (e.g., slow speed, intermittent failures) might not be fully revealed.

Unlike f3write which fills the entire device with test patterns (destroying existing data), f3probe writes a small amount of data, temporarily stores the original data from those locations, performs its test, and then restores the original data. This makes it suitable for testing drives with existing files.

f3probe primarily works by testing specific regions of the flash drive, especially towards the end of the reported capacity, where fraudulent devices often fail to retain data. It reports the actual usable capacity found.

f3probe is part of the f3 (Fight Flash Fraud) project, initiated and developed by Michel Martens. The f3 suite was created to combat the widespread issue of counterfeit flash storage devices. While earlier tools like f3write and f3read provided comprehensive (but destructive) testing, f3probe was introduced later to offer a quicker, non-destructive method for initial assessment, addressing the need for a safer way to verify devices without erasing existing data.

f3write(1), f3read(1), f3fix(1), f3brew(1), lsblk(8), dd(1)