Using and Imaging NVMe drives: tips and tricks

Hi there!??

Welcome back to Plug, Image, Repeat, the monthly newsletter where we share practical tips and tricks to help you use our imagers efficiently. We’re glad you’re here.

Increasing data volumes are reshaping the data storage industry. Traditional HDDs are fading, replaced by NVMe (Non-Volatile Memory Express), the next-gen storage technology. With lightning-speed data transfer rates, high performance, easy compatibility, multitasking capabilities, and low latency, NVMe is the new favorite of consumers and businesses.?

NVMe market overview

Аccording to analysts' forecasts, the Non-Volatile Memory Express (NVMe) market is expected to reach USD 163.5 Billion by 2025.??

SSD tips and tricks

In particular, it is important for PCI Gen 4 and Gen 5 NVMe drives. High temperatures both the performance and the lifespan of an SSD. NAND flash memory and controllers degrade faster at higher temperatures. It's essential to cool them to maximize their life cycle.

Don't use several SSD drives of the same model in your server, NAS, RAID. In case of firmware failure, all these drives can stop working. Here is a dramatic case with 23 Samsung 860 EVO drives that went dead.

To optimize costs, manufacturers of inexpensive SSDs buy cheaper but significantly outdated NAND chips sold by small companies, which at times can be defective. In such chip parties, one chip can be good but another can be bad.

Any SSD uses the Flash Translation Layer (FTL) to track where data is stored. However, continuous updates to the FTL can scatter data, leading to "write amplification". It means that a small change in data may need a lot of internal rewrites, causing a faster wearout, which is especially noticeable with the cheaper QLC memory. This wearout can lead to the loss of FTL data and therefore a non-working drive.

Due to overprovisioning, many blocks of memory are not addressable and may still contain data after wiping. The reliable way to erase all drive data is to use the NVMe commands recommended in the NVM Express Work Group specifications.?

On top of that, you can also learn how Sanitize differs from Format NVM:

3 simple steps to image NVMe drives the right way

Due to their growing prevalence, more and more NVMe drives are appearing in forensic cases. More frequently than before, they contain evidence in the form of documents, internet history, emails, location data and other files potentially associated with crimes. Gathering information from these drives can be difficult and time-consuming especially when you need to сonnect or exchange them quickly. Certainly, when a crime is committed, every minute counts. To help you with the ever-growing number of NVMe M.2 drives in forensic cases, we equipped TaskForce 2 with four M.2/U.2 ports. So let’s take a deeper dive into imaging NVMe drives!??

Step 1??: Connect drives correctly

To connect a drive, follow these steps:

Step 2??: Always diagnose before imaging

At Atola Technology, we are strong advocates for running diagnostics on every evidence drive.

Do you wonder why?

• Firstly, if a drive is damaged, diagnostics will help you make an informed decision on how to recover evidence from that drive using TaskForce 2.

• Secondly, the diagnostic report will tell you if partitions have been detected on the drive. This will help you prioritize the drive among others involved in the same case.

• Finally, TaskForce 2 gives you an estimate of how long it will take to image the drive.

Here is our screencast: How to diagnose a drive?

Step 3??: Prioritize your data: Image and Logical?

Image and Logical are not just two buttons on the interface. They represent two different approaches. When you click the Imaging button, TaskForce 2 creates a bit-by-bit copy of the entire drive, while Logical allows users to select specific partitions, folders or files.

To save time, use the smart include/exclude filters.

The logical imaging module in TaskForce 2 has powerful and flexible filtering settings. You can include or exclude: different file types, their size and time when the files were created/modified/accessed as well as whole folders and partitions. A manual selection of individual elements is available, too.?

That’s all. It is time to put these steps into practice!??

Bonus??TaskForce 2023.9 NVMe feature sneak peek

The next firmware update, currently in development, will introduce an NVMe status bar (at the very bottom of the TaskForce interface). If you're working with an NVMe drive, you'll be able to get a better sense of the drive's health by tracking its temperature and active power state (APS).

??More details on NVM status indicators:

• Link: It's only enabled when device presence is detected and the link with its NVMe controller is initialized.

• RDY: Ready. This bit is enabled when the NVMe controller is ready to accept commands.

• CFS: Controller Fatal Status. This bit is enabled if the controller has an error condition and is unable to communicate with software via completion queue entries.

• APS: Active Power State. This field indicates the current power state of the controller, or the power state into which the controller is transitioning. APS 0 is the most power-consuming state activated when the drive is reading or writing blocks. Go to Diagnose to find all possible drive's power states.

• Temp: Current drive temperature. It turns orange if it exceeds the drive's Warning temperature level and red if it exceeds the Critical temperature level.

Thanks for reading! Make sure you never miss an issue by clicking the "Subscribe"?? button in the upper right corner of the page. For more articles and insights, visit our website.?

If you have any questions, please ask us or send them using the comments section below.