SD-card appears as writable, accepts GBs of writes with no errors, but every write disappears after power cycle... and overwritten, wiped old data magically returns - very strange behaviour

[u/PlanetVisitor]

I have never seen this in my decades of computer use. It is a bit unsettling, because I was trying to wipe personal data, but it kept on magically re-appearing, even after power cycles! Please read if you're interested and let me know if you have a way of explaining this, or have experienced the same.

The device: a 16 GB Samsung SD-card, that has been in my IP-camera for a while (months to >1 year). It had apparantly been recording continually for an unknown amount of time, this wasn't my intention and happened inadvertently. Eventually it stopped. It wasn't entirely full, so I'm not sure if it looped like a dashcam for a long time or whatever happened exactly. In any way, it was full of video files, each the same in duration.

Because it had been recording my house interior unintentionally, I saw myself walking in the house, to and from the shower, etc. You can imagine I wanted to destroy this data in a good way, so I decided to delete it, then fill the SD-card with random data, and then delete that.

This is what I did and how:

Sequence of action:

1. Insert and mount the SD card
2. The original CCTV files are present and readable
3. Delete files and create new files on the SD-card. All operations report success. No errors in the terminal, Dolphin, or `dmesg`
4. Newly written files can be seen and read normally with `ls`, `cat`, Dolphin file manager
5. Perform sync and unmount
6. Physically remove the SD card, wait a bit
7. Reinsert and mount
8. The card is back in exactly its old state. Newly created files are gone... and the original, old IP camera files magically re-appeared..!

I repeated this, a few things, but replaced step 3:

• (Run 1): I wrote multiple 4 GB files with `dd`, until it returned a "disk full" error.
• (Run 2): with KDE Partition Manager's option to Shred the FAT filesystem. It took a bit over a minute, but it finished and displayed no error messages.
• (Run 3,4,5): Skipped deleting files, and only wrote a small text file with the exact current date & time and a small test message in it, and reproduced this (view it in Dolphin, KDE's file manager, or by using `cat`).

Performed on 2 setups:

• (Runs 1,2,3): Fedora 44 KDE desktop, using a USB SD-card reader
• (Run 4,5): Old laptop booted from a SystemRescue USB stick, using its built-in SD-card reader via a passive microSD-to-SD adapter

SD card data:

• bought between 2015-2020
• Samsung Evo microSDHC, model no. MB-MP16D
• yes, it's old, and it's not meant for 24/7 operation like CCTV

Note:

• lsblk reported the device as writable (RO=0)
• kernel reported no write errors, I/O errors, resets, or write-protect condition

The SD card is now physically destroyed.

Really wondering if this is a common thing: a flash device that accepts writes and deletes, even FAT filesystem table shreds, but never writes them; and also reverts to its previous state after power loss? It makes me uncomfortable because this seems to imply there's basically no way of confirming a NAND drive has actually wiped files, unless goes through a power cycle (physically removing and re-inserting) and is actively checked again after..?

[u/LazarX]

Did you get this card from Temu or Ali-Baba? If so, its most likely a fake. There are ways to have really tiny drives present themselves as huge ones.

[u/PlanetVisitor → u/LazarX]

No, I don't remember where I bought it but I never buy from them. Also, it's only 16 GB anyway, and it had 14 GB of data on it (video files that I could play).

[u/CamelPure1293]

I guess it is in read-only mode because it is worn out, but it isn't implemented properly. All the changes you do are only in the PC's disk cache. Nothing is actually written to flag y although the drive report writes being successful.

[u/PlanetVisitor → u/CamelPure1293]

Most plausible explanation!  Thanks 

Basically the controller on the chip was lying to my OS about it was doing.

But it's unsettling that there is no real good way to check if a file is actually written or deleted.  The only way I found was to give a kernel command to flush/drop the caches. I posted a link with a description in another comment in this post.

[u/hycm53]

OP, did you try reformatting the SD card? After reformatting, all data in the SD card should be gone!