NVMe Imaging Proble...
 
Notifications
Clear all

NVMe Imaging Problems - HELP

6 Posts
6 Users
0 Likes
1,133 Views
ssstu
(@ssstu)
Posts: 12
Active Member
Topic starter
 

Hi all,

I have a Dell XPS Laptop (Model P56F001) which has a NVMe PCIe SSD that I am struggling to image. I am hoping somebody in this community might have experienced this and can help?

I have tried various Forensic Boot Disks to image the device, but to no success (tried the latest version of Caine and Paladin).

I recently created a WINFE10 boot disk which I hoped would have worked, but unfortunately has not.

Like all Forensic Boot Disks I have used, the NVMe PCIe SSD doesn't appear when enumerating available disks to be imaged.

I suspect this to be a driver issue, but my research hasn't found an answer.

Has anyone out there had this issue as of yet?

Thank you.

 
Posted : 13/11/2017 8:48 am
JimC
 JimC
(@jimc)
Posts: 84
Trusted Member
 

WinFE is based on WinPE which is a stripped down Windows installation. The most likely explanation for the problem with WinFE is that the drivers for the PCI-e are missing from the image.

You can download the drivers from Dell here

http//www.dell.com/support/home/us/en/04/product-support/product/xps-15-9550-laptop/drivers

And then use DSIM to inject the drivers into the WinFE image. There is a walk through here for this procedure

http//4nzx.blogspot.co.uk/2016/05/creating-winfe-boot-disc-with-macbook.html

Jim

www.binarymarkup.com

 
Posted : 13/11/2017 10:25 am
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

That or Linux can be your friend. A version such as Parrot Linux or Sparky Linux should have no problem finding a driver even in the live build. Then you can use gnu ddrescue to directly image the NVMe device. I've done it dozens of times without any issue.

 
Posted : 13/11/2017 5:08 pm
alimenson
(@alimenson)
Posts: 1
New Member
 

Very informative thread.

 
Posted : 13/11/2017 5:11 pm
UnallocatedClusters
(@unallocatedclusters)
Posts: 570
Honorable Member
 

Another imaging tool option https://www.osforensics.com/tools/create-disk-images.html

 
Posted : 13/11/2017 7:13 pm
Bunnysniper
(@bunnysniper)
Posts: 257
Reputable Member
 

You can easily identify the necessary driver using the Computer Management Console. Attach the NVMe device and have a look at the devide properties. Then make sure you add the matching drivers to your Windows FE medium with the already mentioned "dism.exe" tool.

 
Posted : 14/11/2017 1:28 pm
Share:
Share to...