±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 34614
New Yesterday: 0 Visitors: 166

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

NVMe Imaging Problems - HELP

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 3:48 am

Hi all,

I have a Dell XPS Laptop (Model P56F001) which has a NVMe PCIe SSD that I am struggling to image. I am hoping somebody in this community might have experienced this and can help?

I have tried various Forensic Boot Disks to image the device, but to no success (tried the latest version of Caine and Paladin).

I recently created a WINFE10 boot disk which I hoped would have worked, but unfortunately has not.

Like all Forensic Boot Disks I have used, the NVMe PCIe SSD doesn't appear when enumerating available disks to be imaged.

I suspect this to be a driver issue, but my research hasn't found an answer.

Has anyone out there had this issue as of yet?

Thank you.  


Re: NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 5:25 am

WinFE is based on WinPE which is a stripped down Windows installation. The most likely explanation for the problem with WinFE is that the drivers for the PCI-e are missing from the image.

You can download the drivers from Dell here:


And then use DSIM to inject the drivers into the WinFE image. There is a walk through here for this procedure:





Re: NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 12:08 pm

That or Linux can be your friend. A version such as Parrot Linux or Sparky Linux should have no problem finding a driver even in the live build. Then you can use gnu ddrescue to directly image the NVMe device. I've done it dozens of times without any issue.
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 

Senior Member


Post Posted: Mon Nov 13, 2017 12:11 pm

Very informative thread.  


Re: NVMe Imaging Problems - HELP

Post Posted: Mon Nov 13, 2017 2:13 pm

Another imaging tool option: www.osforensics.com/to...mages.html  

Senior Member

Re: NVMe Imaging Problems - HELP

Post Posted: Tue Nov 14, 2017 8:28 am

You can easily identify the necessary driver using the Computer Management Console. Attach the NVMe device and have a look at the devide properties. Then make sure you add the matching drivers to your Windows FE medium with the already mentioned "dism.exe" tool.  

Senior Member

Page 1 of 1