±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 33043
New Yesterday: 2 Visitors: 147

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

NVMe Imaging Problems - HELP

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 2:48 am

Hi all,

I have a Dell XPS Laptop (Model P56F001) which has a NVMe PCIe SSD that I am struggling to image. I am hoping somebody in this community might have experienced this and can help?

I have tried various Forensic Boot Disks to image the device, but to no success (tried the latest version of Caine and Paladin).

I recently created a WINFE10 boot disk which I hoped would have worked, but unfortunately has not.

Like all Forensic Boot Disks I have used, the NVMe PCIe SSD doesn't appear when enumerating available disks to be imaged.

I suspect this to be a driver issue, but my research hasn't found an answer.

Has anyone out there had this issue as of yet?

Thank you.  

ssstu
Newbie
 
 
  

Re: NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 4:25 am

WinFE is based on WinPE which is a stripped down Windows installation. The most likely explanation for the problem with WinFE is that the drivers for the PCI-e are missing from the image.

You can download the drivers from Dell here:

www.dell.com/support/h...op/drivers

And then use DSIM to inject the drivers into the WinFE image. There is a walk through here for this procedure:

4nzx.blogspot.co.uk/20...cbook.html


Jim

www.binarymarkup.com  

JimC
Member
 
 
  

Re: NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 11:08 am

That or Linux can be your friend. A version such as Parrot Linux or Sparky Linux should have no problem finding a driver even in the live build. Then you can use gnu ddrescue to directly image the NVMe device. I've done it dozens of times without any issue.
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 

JaredDM
Senior Member
 
 
  

update

Post Posted: Mon Nov 13, 2017 11:11 am

Very informative thread.  

alimenson
Newbie
 
 
  

Re: NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 1:13 pm

Another imaging tool option: www.osforensics.com/to...mages.html  

UnallocatedClusters
Senior Member
 
 
  

Re: NVMe Imaging Problems - HELP

Post Posted: Tue Nov 14, 2017 7:28 am

You can easily identify the necessary driver using the Computer Management Console. Attach the NVMe device and have a look at the devide properties. Then make sure you add the matching drivers to your Windows FE medium with the already mentioned "dism.exe" tool.  

Bunnysniper
Senior Member
 
 

Page 1 of 1