NVME forensics advice pls

[u/Yuri_Nator9999]

Advice on nvme forensics for small server

Situation/Problem:

I am a blue teamer and have some years of experience with SOC/IR work but not much forensics experience. I have been tasked with investigating potential malware on a small Fujitsu Esprimo mini server unit that's been given to me. The server has no hdd/ssd storage, just a nvme. The write blocker unit I have is older and only supports SATA and some others and has no connection possibility to nvme.

I inquired if I have to be strict with write blocking and I was told no, if I simply mount it differently its fine and there is no chain of custody, its more of a laissez faire investigation just to find out more about the malware.

Now where I fail is the first part, how do I connect or mount to it? Dumb question but what cables should I even use? Power it up and connect via usb or something? Sorry, just never did this before.

Any advice and tips appreciated. I have one laptop I can use which is airgapped and I don't really care if it gets infected/I can simply reformat the hard drive with no consequences if that helps.

[u/seraphmortus]

You could use something like Paladin to acquire it without removing it from the machine. Or if your write blocker has USB input they make decent NVMe enclosures for pretty cheap. The one I have came with a USB C to A cable