NVMe PCIe SSD to SA...
 
Notifications
Clear all

NVMe PCIe SSD to SATA

7 Posts
4 Users
0 Likes
1,791 Views
(@cults14)
Posts: 367
Reputable Member
Topic starter
 

Hello wonder if anyone can help.

Corporate systems here are protected by McAfee WDE, this is not generally an issue as we can boot them from a custom USB stick which has McAfee DETech 7.2 on it and use the Authorisation and Authentication options in DETech which lets us use FTK Imager to make images.

If we need to remove drives from suspect systems and image them (best practice, but not always practical), with SATA disks, we can connect them to a forensic host laptop via Tableau SATA and in DETech change the boot disk option from 0 to 1 (or whatever). This includes SATA M.2 SSD disks for which we use a Startech SATA adapter.

The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.

So I'm wondering if anyone else has got round this specifically (a) using a laptop as a forensic workstation, (b) with McAfee DETech, and © with NVMe PCIe SSD disks

I know it's pretty specific

Regards

Peter

 
Posted : 06/02/2020 9:35 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.

Wouldn't something like these do?
https://www.addonics.com/products/ad25m2u.2.php

jaclaz

 
Posted : 06/02/2020 9:47 am
(@trewmte)
Posts: 1877
Noble Member
 

The challenge with NVMe PCIe SSD is that I haven't found a suitable SATA adapter (I don;t even know if it's possible!), and if we use the Tableau T7 USB 3.0 bridge with adapter cable, DETech doesn't recognise USB connections in the boot disk option.

So something like this wouldn't work for you?

https://www.media-clone.net/SuperImager-Plus-8-NVME-SATA-Forensic-Unit-p/sif-0037-00a.htm

Or this wouldn't work for you?

https://www.amazon.co.uk/USB-NVMe-PCIe-Enclosure-PCI-/dp/B07GPB1VR4?

 
Posted : 06/02/2020 10:41 am
(@cults14)
Posts: 367
Reputable Member
Topic starter
 

Thank you gents

Jaclaz I think the Addonics one might be suitable, I'll chase it up. Have you used it? I read somewhere (can't recall where) that there can be issues going from PCIe to SATA (again, sorry but I don't recall what those issues are)

trewmte - the SuperImager Plus looks expensive (I know, I didn't specifiy price!). I'll enquire about that but it doesn't look as if they have a reseller or distributor in UK
The USB bridge may not work in this instance as the connection to the host is via USB and DETech doesn't recognise USB disks

Regards

Peter

 
Posted : 06/02/2020 11:22 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Jaclaz I think the Addonics one might be suitable, I'll chase it up. Have you used it? I read somewhere (can't recall where) that there can be issues going from PCIe to SATA (again, sorry but I don't recall what those issues are)

I cannot say about the specific item, what I can tell you (as a generic experience) is that the Addonics stuff I got always worked just fine, and BTW if you look closely at the SuperImagerPlus pictures, you will find strange similarities between the shown Nvme adapters and and the Adaptec one (in the low profile 7 mm version).

But you are right, my bad, the "mess" is about M2 (form factor) and NvMe/SATA (bus)
https://www.forensicfocus.com/Forums/viewtopic/t=18034/

You see, I actually wrote about that mess and just fell for the same oops .

The specific Addonics adapter I posted a link to is Nvme (device side) but it is not SATA (on the bus) it is U2 (even more confusion), so in itself and without something *like* the SuperImagerPlus. it won't work ( .

jaclaz

 
Posted : 06/02/2020 1:05 pm
mokosiy
(@mokosiy)
Posts: 54
Trusted Member
 

The USB bridge may not work in this instance as the connection to the host is via USB and DETech doesn't recognise USB disks

I can recommend using this adapter https://www.amazon.com/dp/B07NPFT91M

We heavily stress-tested it in-house and found it working in almost all cases. I assume any hardware imager with USB port (not a USB bridge) will allow imaging NVMe drives via the adapter.

 
Posted : 07/02/2020 7:57 am
(@cults14)
Posts: 367
Reputable Member
Topic starter
 

raydenvm - thanks but as long as the connection to the host is USB, in my experience so far DETech doesn't recognise anyhting connected via USB. That goes for the Tableau T7 USB 3 (with PCI adapter), Tableau T8 USB 2, or any USB enclosure or stick.

I have another thought, I'll try to check and get back to you

Regards

Peter

 
Posted : 07/02/2020 9:28 am
Share: