How to Spot Counterfeit or Relabeled SSDs and Server Memory

Counterfeit enterprise storage and memory rarely looks like a cheap fake. The more common problems are subtler: used drives relabeled and sold as new, modules with remarked chips or a borrowed label, parts pulled from other systems and sold outside the channel, and, mostly at the consumer end, flash devices that report more capacity than they have. Each of these can be caught with a short set of checks at goods-in, before a part goes into a server. Work from the outside in (packaging, label, then what the device reports to the host), and treat any single mismatch as a reason to quarantine the part. This guide covers those checks for SSDs and server RAM, and explains why the source you buy from matters more than any of them.

How can I tell if an SSD is counterfeit?

• Packaging: labels on the box that match the drive inside, and packaging consistent with how that manufacturer ships. Resealed anti-static bags, generic boxes or missing labels on a part sold as new are warning signs.
• Label: sharp printing, consistent fonts, and a model number, capacity and interface that agree with each other. A label that says NVMe U.2 on a drive with a SATA connector, or a capacity the manufacturer does not offer in that model line, ends the inspection.
• Serial numbers: the serial on the box, the label and the value the drive reports must all match. Read it with smartctl -i on SATA and SAS drives, or nvme id-ctrl on NVMe drives.
• Manufacturer lookup: where the manufacturer or server OEM offers a warranty or serial check, run the serial through it. A serial that is unknown, registered to a different region, or already out of warranty on a new drive is a problem.
• Firmware: the reported firmware revision should be one the manufacturer publishes for that model. An unfamiliar firmware string, or a model string that does not match the label, points to a relabeled or reprogrammed drive.
• Link negotiation: the drive should train at the link it was built for. A PCIe 4.0 x4 drive such as the Samsung PM9A3 960GB should show a Gen4 x4 link in lspci -vv when installed in a Gen4 slot and backplane, and a 24Gb/s SAS drive such as the Samsung PM1653 1.92TB should negotiate its full rate on a 24Gb/s controller.

What should SMART data show on a new enterprise SSD?

SMART data is the easiest way to catch a used drive sold as new, because a new label and box do not change the drive's internal counters. On a new drive, power-on hours should be close to zero, host writes and total data written should be negligible, and the wear or percentage-used indicator should show essentially no wear. Media and data integrity error counts should be zero. On NVMe, nvme smart-log shows power-on hours, data units written and percentage used directly. On SATA and SAS, smartctl -a shows the equivalent attributes, although attribute names vary by vendor.

Record these values for every drive at goods-in. Besides catching problems, the record gives you a baseline for any warranty claim later. A drive that arrives with thousands of power-on hours, or with its wear indicator already moving, has had a previous life regardless of the packaging.

How do I test the real capacity of an SSD?

Fake-capacity devices report a large size to the operating system but store only a fraction of it, silently overwriting earlier data once the real flash is full. They are far more common among consumer USB and SATA devices than among enterprise drives, but a capacity test is cheap insurance for any drive from an unfamiliar source. The method is to write known data across the whole reported capacity and read it back. Tools such as f3 on Linux or H2testw on Windows do exactly this, and a destructive badblocks write test does the same at a lower level. Only run these on an empty drive.

A read check against the rated figure is a useful sanity test as well. The Samsung PM893 480GB is rated for up to 560 MB/s sequential read on 6Gb/s SATA. A drive that falls far short of its rating in a simple sequential read on a healthy port deserves a closer look, although one test is not proof either way.

How do I verify server memory is genuine?

Memory fakes tend to be remarked chips, relabeled modules, or modules whose SPD data has been rewritten to claim a higher speed or a different part number. The checks:

• Label against the order: capacity, generation, speed, module type (RDIMM or LRDIMM) and part number should match exactly. An SK hynix 32GB DDR5-5600 RDIMM should be labeled as a 32GB DDR5-5600 PC5-44800 registered ECC module, not something close to it.
• SPD against the label: the server BIOS, the BMC hardware inventory, or dmidecode -t memory on Linux shows what the firmware read from each module. Manufacturer, part number, capacity, speed and rank should agree with the label.
• Physical build: DRAM packages should carry consistent markings from one maker, with no signs of sanding or reprinting. Registered DDR5 modules carry a register clock driver and an on-module power management IC, so check that the module has the components its type requires.
• Specification: DDR5 RDIMMs run at 1.1V and DDR4 at 1.2V. The Samsung 16GB DDR4-3200 RDIMM is specified at CL22 and 1.2V; SPD values that disagree with the published specification are a red flag.
• Serials: record module serials at goods-in and check them with the manufacturer where a lookup exists.

What does a memory burn-in look like?

Visual checks catch relabeling; only testing catches marginal or failing chips. Before a server goes into production, run several passes of a full memory test such as MemTest86 or the server vendor's built-in diagnostics, then run the system under a sustained, memory-heavy load. Afterwards, check the BMC system event log and the operating system's error reporting (EDAC counters or rasdaemon on Linux) for correctable ECC errors. New memory from a clean source should log none. A module that throws correctable errors during burn-in is a return, not a module to keep an eye on.

What are the risks of grey-market components?

Grey-market parts are genuine products sold outside the manufacturer's authorized channel. They are not necessarily fake, but they carry risks that counterfeits share. Warranty is the most common: manufacturers can decline service for parts sold outside the intended channel or region, and a seller's own warranty is only as good as the seller. Provenance is the second: you cannot tell whether a part was stored and handled correctly, or pulled from another system. The third is the counterfeit risk itself, which rises the further a part travels from the manufacturer. Our article on grey-market GPU risks covers the same issues for accelerators, and our list of procurement red flags applies to any component.

A new label changes the sticker, not the drive's internal counters. Check the serial, the firmware and the SMART log, and a used or relabeled part will usually give itself away.

What should you ask a supplier for?

• Confirmation that the parts are new and sourced through authorized distribution.
• Manufacturer part numbers on the quote and invoice, not just descriptions.
• Serial numbers on the packing list, so goods-in can match them to the parts.
• The warranty terms: who honors the warranty and how a claim is made. For OEM-channel enterprise drives and memory, warranty service may run through the distribution chain rather than a consumer returns portal, so get the answer in writing.
• A dead-on-arrival and returns process, in writing, before you place the order.

Nexus Compute supplies new SSDs and memory, including the Samsung PM9A3, PM1643a and PM1653 and registered DDR4 and DDR5 modules from Samsung, SK hynix and Micron, sourced through authorized distribution with the full manufacturer warranty. Compatibility is checked against your platform before dispatch. Request a quote with your server model and we will respond within 48 business hours.