Because these controllers can be easily reprogrammed using publicly available MP Tools, devices using Alcor chips are often subjects of interest in digital forensics. The ability to rewrite the firmware allows for the creation of "BadUSB" attacks or the manipulation of reported drive capacities (a common fraud where a small drive is programmed to report a larger capacity).
A healthy USB device identifies itself with a VID (Vendor ID) and PID (Product ID). For example, Alcor’s official VID is often 058F. If Windows sees 058F:FA00, it looks for a driver. If none exists, you get the "Unknown" status. alcor micro unknown fa00 f w fa04 top
Reasons for the FA00 enigma:
Users frequently search for this string when their hardware fails to initialize. In the case of Alcor FA00, this is often caused by: Such devices can still operate as standard MSC;
The OS (Windows/Linux) issued a vendor-specific SCSI command or USB control transfer to the Alcor device. The device responded with a pattern the host driver did not recognize—either a malformed response or a debug stub left active in production firmware. Because these controllers can be easily reprogrammed using
If you encounter this string in a production environment:
