NVMe Imaging Problems - HELP

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)

NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 2:48 am

Hi all,

I have a Dell XPS Laptop (Model P56F001) which has a NVMe PCIe SSD that I am struggling to image. I am hoping somebody in this community might have experienced this and can help?

I have tried various Forensic Boot Disks to image the device, but to no success (tried the latest version of Caine and Paladin).

I recently created a WINFE10 boot disk which I hoped would have worked, but unfortunately has not.

Like all Forensic Boot Disks I have used, the NVMe PCIe SSD doesn't appear when enumerating available disks to be imaged.

I suspect this to be a driver issue, but my research hasn't found an answer.

Has anyone out there had this issue as of yet?

Thank you.

ssstu
Newbie

    Re: NVMe Imaging Problems - HELP

    Post Posted: Mon Nov 13, 2017 4:25 am

    WinFE is based on WinPE which is a stripped down Windows installation. The most likely explanation for the problem with WinFE is that the drivers for the PCI-e are missing from the image.

    You can download the drivers from Dell here:

    www.dell.com/support/h...op/drivers

    And then use DSIM to inject the drivers into the WinFE image. There is a walk through here for this procedure:

    4nzx.blogspot.co.uk/20...cbook.html


    Jim

    www.binarymarkup.com

    JimC
    Member

    Re: NVMe Imaging Problems - HELP

    Post Posted: Mon Nov 13, 2017 11:08 am

    That or Linux can be your friend. A version such as Parrot Linux or Sparky Linux should have no problem finding a driver even in the live build. Then you can use gnu ddrescue to directly image the NVMe device. I've done it dozens of times without any issue.


    Lead Data Recovery Tech at Data Medics® - www.data-medics.com

    JaredDM
    Senior Member

    update

    Post Posted: Mon Nov 13, 2017 11:11 am

    Very informative thread.

    alimenson
    Newbie

    Re: NVMe Imaging Problems - HELP

    Post Posted: Mon Nov 13, 2017 1:13 pm

    Another imaging tool option: www.osforensics.com/to...mages.html

    UnallocatedClusters
    Senior Member

    Re: NVMe Imaging Problems - HELP

    Post Posted: Tue Nov 14, 2017 7:28 am

    You can easily identify the necessary driver using the Computer Management Console. Attach the NVMe device and have a look at the devide properties. Then make sure you add the matching drivers to your Windows FE medium with the already mentioned "dism.exe" tool.

    Bunnysniper
    Senior Member
    Page 1 of 1




    ± Forensic Focus Partners

    ± Your Account



    Site Members:

    New Today: 0 Overall: 33043
    New Yesterday: 0 Visitors: 205

    ± Follow Forensic Focus

    Forensic Focus Facebook Page Forensic Focus on Twitter Forensic Focus LinkedIn Group Forensic Focus YouTube Channel

    RSS feeds: News Forums Articles

    ± Latest Articles

    ± Latest Webinars


    Build a Mobile Site
    View Site in Mobile | Classic
    Share by: