7 Easy Steps to Get Full Access to Evidence on Damaged PCIe NVMe SSDs

Damaged NVMe drives presented a great challenge to digital forensiс examiners, because there was no solution to such cases until now. Surely, the experts could use some adapters to connect healthy drives, but they were not able to do anything with damaged SSDs. And we are the first and only who understood how to recover data from them.

by Roman Morozov

The NVMe Solid State Drives became very popular among home users and corporate entities for their fast speed, great performance and a decent price reduction in recent years. And according to IDC statistics the market share of the PCIe SSD is estimated to grow to 61,4% in 2020.

This means that digital forensics experts will face the NVMe drives more and more often. For sure, there’s nothing too complicated if you deal with a fully functional and healthy drive, and there are some semi-solutions to help you with connecting the PCIe Solid State Drives. But what would you do if a damaged SSD with M.2. PCIe NVMe interface ends up on your table?

This step-by-step guide will show you how to recover evidence from damaged NVMe drives with the NVMe-based ADATA ASX7000NP SSD as an example. If you prefer a video tutorial, check out the end of this article.

Step 1. Connect the damaged NVMe drive to the Port 0 of the PC-3000 Portable III via the M.2 PCIe NVMe SSD/M.2 SATA SSD adapter.

Step 2. Launch the software. The correct port and storage media type are already chosen. You may also use the Autodetect button or choose them manually.

Step 3. Power on the SSD and start the Universal Utility to check the drive’s condition.

The wrong ID and capacity indicate the Firmware corruption.

Step 4. Select the Special Utility for the connected PCIe NVMe device. Then, choose the correct controller and drive family. In our case, it’s the ADATA -> Silicon Motion (NVMe) controller.

If the connected drives don’t have serious issues with the internal firmware, the Special Utility, controller, and SSD family will be autodetected.

Step 5. Switch the NVMe SSD to the Safe Mode and upload the Loader. This will allow the access to technological commands. The Utility will ask about that:

You need to short the pins on your NVMe drive as shown in the Utility and press OK:

When the utility asks, remove shorting and press OK.

Step 6. When the Safe Mode initialized, you need to build the virtual Translator to access the data:

The process takes some time. Please wait until it ends.

Step 7. That’s it! Now you can create a new task in the Data Extractor software based on a currently launched Active utility and save the required data from the extended partition:

As of now, the PC-3000 Portable III supports the following healthy and damaged NVMe SSDs: ADATA XPG SX7000, Radeon R5, HP EX900, Lexar NM600, Zion NFP03, Transcend MTE110S. This list is to be expanded with future software updates.

Bonus! As I’ve promised, here is the video guide on how to recover evidence from damaged ADATA ASX7000NP SSD based on the M.2 PCIe NVMe interface:

About The Author

Roman Morozov is a Head Of Technical Support Department and NAND Data Recovery Instructor at ACE Lab

ACE Lab is the world’s leader in developing the most efficient data recovery solutions for the widest range of logically or/and physically damaged storage media: HDD, SSD, Flash drives, RAID, etc. In 2020, they released the PC-3000 Portable III — easy-to-use equipment to check drives condition and extract evidence from damaged SATA/PATA/USB Hard Disk Drives, SATA/M.2 PCIe NVMe Solid State Drives, and RAID. Сompact size, damaged NVMe support, hardware write protection, reports generation and many other functions make it a must-have tool for digital forensics!

Digital Forensic Community