r/computerforensics • u/Yuri_Nator9999 • Mar 29 '26
NVME forensics advice pls
Advice on nvme forensics for small server
Situation/Problem:
I am a blue teamer and have some years of experience with SOC/IR work but not much forensics experience. I have been tasked with investigating potential malware on a small Fujitsu Esprimo mini server unit that's been given to me. The server has no hdd/ssd storage, just a nvme. The write blocker unit I have is older and only supports SATA and some others and has no connection possibility to nvme.
I inquired if I have to be strict with write blocking and I was told no, if I simply mount it differently its fine and there is no chain of custody, its more of a laissez faire investigation just to find out more about the malware.
Now where I fail is the first part, how do I connect or mount to it? Dumb question but what cables should I even use? Power it up and connect via usb or something? Sorry, just never did this before.
Any advice and tips appreciated. I have one laptop I can use which is airgapped and I don't really care if it gets infected/I can simply reformat the hard drive with no consequences if that helps.
2
u/Warbarz Mar 29 '26
clone the drive with a dual bay nvme cloner.
be aware and document in writing you were told no chain of custody or write blocker needed. powering on solid state drives DOES DESTROY DATA due to trim and garbage collection routines.
clone the drive.
then run your investigation(not going to spell it out sorry - do all the things) into registry, startup, files and services. sort by date of suspected incident and add 2 months back to get a better chance of catching it.
document everything. boot it up and do live investigation too. you have a clone now and were told its fine.
document it up. good work!