Hello wonder if anyone can help.
Corporate systems here are protected by McAfee WDE, this is not generally an issue as we can boot them from a custom USB stick which has McAfee DETech 7.2 on it and use the Authorisation and Authentication options in DETech which lets us use FTK Imager to make images.
If we need to remove drives from suspect systems and image them (best practice, but not always practical), with SATA disks, we can connect them to a forensic host laptop via Tableau SATA and in DETech change the boot disk option from 0 to 1 (or whatever). This includes SATA M.2 SSD disks for which we use a Startech SATA adapter.
The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.
So I'm wondering if anyone else has got round this specifically (a) using a laptop as a forensic workstation, (b) with McAfee DETech, and © with NVMe PCIe SSD disks
I know it's pretty specific
Regards
Peter
The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.
Wouldn't something like these do?
https://
jaclaz
The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.
So something like this wouldn't work for you?
https://
Or this wouldn't work for you?
https://
Thank you gents
Jaclaz I think the Addonics one might be suitable, I'll chase it up. Have you used it? I read somewhere (can't recall where) that there can be issues going from PCIe to SATA (again, sorry but I don't recall what those issues are)
trewmte - the SuperImager Plus looks expensive (I know, I didn't specifiy price!). I'll enquire about that but it doesn't look as if they have a reseller or distributor in UK
The USB bridge may not work in this instance as the connection to the host is via USB and DETech doesn't recognise USB disks
Regards
Peter
Jaclaz I think the Addonics one might be suitable, I'll chase it up. Have you used it? I read somewhere (can't recall where) that there can be issues going from PCIe to SATA (again, sorry but I don't recall what those issues are)
I cannot say about the specific item, what I can tell you (as a generic experience) is that the Addonics stuff I got always worked just fine, and BTW if you look closely at the SuperImagerPlus pictures, you will find strange similarities between the shown Nvme adapters and and the Adaptec one (in the low profile 7 mm version).
But you are right, my bad, the "mess" is about M2 (form factor) and NvMe/SATA (bus)
https://www.forensicfocus.com/Forums/viewtopic/t=18034/
You see, I actually wrote about that mess and just fell for the same oops .
The specific Addonics adapter I posted a link to is Nvme (device side) but it is not SATA (on the bus) it is U2 (even more confusion), so in itself and without something *like* the SuperImagerPlus. it won't work ( .
jaclaz
The USB bridge may not work in this instance as the connection to the host is via USB and DETech doesn't recognise USB disks
I can recommend using this adapter
We heavily stress-tested it in-house and found it working in almost all cases. I assume any hardware imager with USB port (not a USB bridge) will allow imaging NVMe drives via the adapter.
raydenvm - thanks but as long as the connection to the host is USB, in my experience so far DETech doesn't recognise anyhting connected via USB. That goes for the Tableau T7 USB 3 (with PCI adapter), Tableau T8 USB 2, or any USB enclosure or stick.
I have another thought, I'll try to check and get back to you
Regards
Peter