You are yapping your ass off. This is a hardware mod, not a software package. Its literally using a custom storage controller chip that only physically unlocks the connection to the secret storage once it detects a certain key file on the decoy storage. They would have to xray the drive individually at close range with high resolution and know a lot about electronics to even come close to figuring out that something is different. There is no way to detect a fake USB HID so unless they open it they wont be noticing shit.
You’re completely confusing device classes and how forensic acquisition works.
First, it’s a USB Mass Storage device, not a USB HID (Human Interface Device). Mass Storage operates via SCSI block commands wrapped in USB packets.
Second, even if the custom firmware successfully fakes the LBA table to report 8 GB, it fails at the protocol level. Forensic tools don’t just read files—they issue low-level SCSI INQUIRY and MODE SENSE commands. Commercial flash controllers (Phison, Silicon Motion) have hardcoded ASIC signatures and proprietary descriptors. A generic CH569 MCU running C code trying to fake these descriptors or pass off software-bridged microSD reads introduces packet latency, timing jitter, and missing SCSI pages that log protocol anomalies during raw acquisition.
Finally, software doesn’t matter if they look at the hardware. Modern 3D CT/X-ray baggage scanners visually isolate silicon footprints instantly without opening the casing. A standard commercial drive is a single integrated ASIC on NAND. A board with a generic CH569 MCU, voltage regulators, UART test points, and a physical microSD socket stands out.
You are yapping your ass off. This is a hardware mod, not a software package. Its literally using a custom storage controller chip that only physically unlocks the connection to the secret storage once it detects a certain key file on the decoy storage. They would have to xray the drive individually at close range with high resolution and know a lot about electronics to even come close to figuring out that something is different. There is no way to detect a fake USB HID so unless they open it they wont be noticing shit.
You’re completely confusing device classes and how forensic acquisition works.
First, it’s a USB Mass Storage device, not a USB HID (Human Interface Device). Mass Storage operates via SCSI block commands wrapped in USB packets.
Second, even if the custom firmware successfully fakes the LBA table to report 8 GB, it fails at the protocol level. Forensic tools don’t just read files—they issue low-level SCSI INQUIRY and MODE SENSE commands. Commercial flash controllers (Phison, Silicon Motion) have hardcoded ASIC signatures and proprietary descriptors. A generic CH569 MCU running C code trying to fake these descriptors or pass off software-bridged microSD reads introduces packet latency, timing jitter, and missing SCSI pages that log protocol anomalies during raw acquisition.
Finally, software doesn’t matter if they look at the hardware. Modern 3D CT/X-ray baggage scanners visually isolate silicon footprints instantly without opening the casing. A standard commercial drive is a single integrated ASIC on NAND. A board with a generic CH569 MCU, voltage regulators, UART test points, and a physical microSD socket stands out.