Join Us!

NVMe PCIe SSD to SA...
 
Notifications
Clear all

NVMe PCIe SSD to SATA  

  RSS
Cults14
(@cults14)
Active Member

Hello wonder if anyone can help.

Corporate systems here are protected by McAfee WDE, this is not generally an issue as we can boot them from a custom USB stick which has McAfee DETech 7.2 on it and use the Authorisation and Authentication options in DETech which lets us use FTK Imager to make images.

If we need to remove drives from suspect systems and image them (best practice, but not always practical), with SATA disks, we can connect them to a forensic host laptop via Tableau SATA and in DETech change the boot disk option from 0 to 1 (or whatever). This includes SATA M.2 SSD disks for which we use a Startech SATA adapter.

The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.

So I'm wondering if anyone else has got round this specifically (a) using a laptop as a forensic workstation, (b) with McAfee DETech, and © with NVMe PCIe SSD disks

I know it's pretty specific

Regards

Peter

Quote
Posted : 06/02/2020 9:35 am
jaclaz
(@jaclaz)
Community Legend

The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.

Wouldn't something like these do?
https://www.addonics.com/products/ad25m2u.2.php

jaclaz

ReplyQuote
Posted : 06/02/2020 9:47 am
trewmte
(@trewmte)
Community Legend

The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.

So something like this wouldn't work for you?

https://www.media-clone.net/SuperImager-Plus-8-NVME-SATA-Forensic-Unit-p/sif-0037-00a.htm

Or this wouldn't work for you?

https://www.amazon.co.uk/USB-NVMe-PCIe-Enclosure-PCI-/dp/B07GPB1VR4?

ReplyQuote
Posted : 06/02/2020 10:41 am
Cults14
(@cults14)
Active Member

Thank you gents

Jaclaz I think the Addonics one might be suitable, I'll chase it up. Have you used it? I read somewhere (can't recall where) that there can be issues going from PCIe to SATA (again, sorry but I don't recall what those issues are)

trewmte - the SuperImager Plus looks expensive (I know, I didn't specifiy price!). I'll enquire about that but it doesn't look as if they have a reseller or distributor in UK
The USB bridge may not work in this instance as the connection to the host is via USB and DETech doesn't recognise USB disks

Regards

Peter

ReplyQuote
Posted : 06/02/2020 11:22 am
jaclaz
(@jaclaz)
Community Legend

Jaclaz I think the Addonics one might be suitable, I'll chase it up. Have you used it? I read somewhere (can't recall where) that there can be issues going from PCIe to SATA (again, sorry but I don't recall what those issues are)

I cannot say about the specific item, what I can tell you (as a generic experience) is that the Addonics stuff I got always worked just fine, and BTW if you look closely at the SuperImagerPlus pictures, you will find strange similarities between the shown Nvme adapters and and the Adaptec one (in the low profile 7 mm version).

But you are right, my bad, the "mess" is about M2 (form factor) and NvMe/SATA (bus)
https://www.forensicfocus.com/Forums/viewtopic/t=18034/

You see, I actually wrote about that mess and just fell for the same oops .

The specific Addonics adapter I posted a link to is Nvme (device side) but it is not SATA (on the bus) it is U2 (even more confusion), so in itself and without something *like* the SuperImagerPlus. it won't work ( .

jaclaz

ReplyQuote
Posted : 06/02/2020 1:05 pm
raydenvm
(@raydenvm)
Junior Member

The USB bridge may not work in this instance as the connection to the host is via USB and DETech doesn't recognise USB disks

I can recommend using this adapter https://www.amazon.com/dp/B07NPFT91M

We heavily stress-tested it in-house and found it working in almost all cases. I assume any hardware imager with USB port (not a USB bridge) will allow imaging NVMe drives via the adapter.

ReplyQuote
Posted : 07/02/2020 7:57 am
Cults14
(@cults14)
Active Member

raydenvm - thanks but as long as the connection to the host is USB, in my experience so far DETech doesn't recognise anyhting connected via USB. That goes for the Tableau T7 USB 3 (with PCI adapter), Tableau T8 USB 2, or any USB enclosure or stick.

I have another thought, I'll try to check and get back to you

Regards

Peter

ReplyQuote
Posted : 07/02/2020 9:28 am
Share: