You’re completely confusing device classes and how forensic acquisition works.

First, it's a USB Mass Storage device, not a USB HID (Human Interface Device). Mass Storage operates via SCSI block commands wrapped in USB packets.

Second, even if the custom firmware successfully fakes the LBA table to report 8 GB, it fails at the protocol level. Forensic tools don't just read files—they issue low-level SCSI INQUIRY and MODE SENSE commands. Commercial flash controllers (Phison, Silicon Motion) have hardcoded ASIC signatures and proprietary descriptors. A generic CH569 MCU running C code trying to fake these descriptors or pass off software-bridged microSD reads introduces packet latency, timing jitter, and missing SCSI pages that log protocol anomalies during raw acquisition.

Finally, software doesn't matter if they look at the hardware. Modern 3D CT/X-ray baggage scanners visually isolate silicon footprints instantly without opening the casing. A standard commercial drive is a single integrated ASIC on NAND. A board with a generic CH569 MCU, voltage regulators, UART test points, and a physical microSD socket stands out.