Do you think TSA/CBP is going to check the flash data lines to see if the MCU is scanning the flash internally?

This isn’t a standard USB flash controller… You would need to break the casing and physically probe it to figure out that something was off as far as I can tell. It’s not like the MCU broadcasts that it is scanning to the USB port.

You would have to be hitting the stick pretty hard, not just a normal file scan to notice the timing being slightly too long in a small portion of the scans. The bigger problem would be that the flash drive would be brand-recognizable if it ends up being mass produced that they might auto-confiscate it, and of course the default file that it searches for being known.

You’re proving my point. The device actually fails both ends of the threat model.

If it’s a casual check, custom hardware is total overkill. You take a standard 1 TB off-the-shelf drive formatted to its full 1 TB capacity as a single partition. You put normal files on it and hide the encrypted header—plus a lightweight host-side decryption utility/bootloader—inside a single JPEG using steganography. To any border agent, OS, or disk tool, the drive is just a healthy 1 TB partition containing readable files and residual random data from a quick format. There are no custom drivers installed, no modified media file sizes, and no missing drive space to trigger software or system flags. Once at your destination, you simply extract the utility from the JPEG on a trusted machine to mount the hidden sectors.

If it’s a high-scrutiny check, this custom hardware actively guarantees you stand out. CBP doesn't need software checks—non-destructive X-ray imaging is standard screening. Under a scan, a mass-produced thumb drive shows a single integrated ASIC on NAND. The Phantom Drive immediately reveals a generic CH569 microcontroller, buck regulators, UART test points, etc.

It visually stands out like a neon sign under basic physical imaging. It doesn’t defeat the threat model—it actively creates the physical hardware anomaly.

If I got it right, you could easily detect this drive by just creating password.txt. as the article says it creation is intercepted and skipped. Hence if there is no password.txt afterwards, you know what you're dealing with. Still, you have to know this AND care.

You’re completely confusing device classes and how forensic acquisition works.

First, it's a USB Mass Storage device, not a USB HID (Human Interface Device). Mass Storage operates via SCSI block commands wrapped in USB packets.

Second, even if the custom firmware successfully fakes the LBA table to report 8 GB, it fails at the protocol level. Forensic tools don't just read files—they issue low-level SCSI INQUIRY and MODE SENSE commands. Commercial flash controllers (Phison, Silicon Motion) have hardcoded ASIC signatures and proprietary descriptors. A generic CH569 MCU running C code trying to fake these descriptors or pass off software-bridged microSD reads introduces packet latency, timing jitter, and missing SCSI pages that log protocol anomalies during raw acquisition.

Finally, software doesn't matter if they look at the hardware. Modern 3D CT/X-ray baggage scanners visually isolate silicon footprints instantly without opening the casing. A standard commercial drive is a single integrated ASIC on NAND. A board with a generic CH569 MCU, voltage regulators, UART test points, and a physical microSD socket stands out.

Yes, but you can just carry encrypted hard drive with you. Hiding encrypted data is useful pretty much only for legal reasons. You want to take it across border and are worried TSA agent will force you to decrypt it or something. What is safer in that case? Carrying a USB stick with hidden encrypted partition or not carrying anything at all and downloading the data later? I would say the latter. Smuggling encrypted data through custom checks into a war zone with limited internet access is the cool but unlikely spy games scenario I was talking about. Encrypted microSD card would be even more secure in that case.

that's like saying "password managers require a password so I don't see the point"

Those recommendations are for protecting data you want to stay a secret; it would also apply to unlocking this fancy USB drive, as a best practice.

The USB still has advantage in that no one will compel you to unencrypt a drive that they don't realize is encrypted, which can be a pretty significant advantage depending on who you're hiding the information from, or why.

you don't have to boot into some special live OS to mount the hidden volume. It can be mounted just like a normal encrypted volume.

They make a very poor job of highlighting something so important in a dense page detailing how to do what they recommend you don't.