Modern NVMe SSDs require specialized approaches for forensic analysis. Each year, the speed and capacity of these devices grow, presenting significant challenges related to both the speed and reliability of transferring large volumes of data when capturing disk images. In this article, we will test the imaging of a high-speed Samsung 980Pro NVMe drive with OSForensics and FTK Imager. As a bonus, we also tested a prototype of our NVMe write-blocker, which yielded some intriguing results.
At first glance, imaging a high-speed SSD seems a lot faster than dealing with a slower one. However, fast storage devices introduce a range of issues that are not typically encountered with slower SATA drives. Here are just a few:
In real-world scenarios, achieving imaging speeds that come close to the advertised continuous read speed of the SSD drive is nearly impossible. The adjusted goal is much more modest; we are aiming at the bandwidth of the “USB port + adapter” combination, which is generally around 10 gigabits per second. Considering USB overhead, the theoretical maximum speed is roughly 1 GB/s.
We’ve previously published detailed benchmarks based on imaging some SATA drives. In Maximizing Disk Imaging Speeds and When Speed Matters: Optimizing Disk Imaging, we discussed the various implications of disk imaging with different forensic tools. Those two articles, however, were dealing with SATA drives, which are much slower compared to modern NVMe devices. This time, we focused on NVMe drives rather than SATA ones. Although we ran a preliminary check with SATA drives to confirm the setup, as expected, the results mirrored our previous tests. The drive we used for the main tests was a Samsung 980Pro NVMe SSD (256 GB).
For this round of testing, we used a different laptop – specifically, a Tecno MEGABOOK S1, featuring an Intel Core i7-13700H processor, 32 GB of RAM, and a fast 1 TB PCIe Gen4x4 SSD. The laptop includes USB 3.2 Gen2 and USB 4 ports.
The NVMe drive we imaged (the 256GB Samsung 980 Pro) was connected to a 10-gigabit Type-C port via a dedicated NVMe to USB adapter, while the image was saved to the laptop’s internal NVMe SSD. This setup ensures a significant speed margin for handling large volumes of data.
We performed data copying tests with both external power and battery power. Unlike previously found on a differenc system, this particular laptop did not demonstrate any speed reduction when switching to battery power. The reason for this discrepancy remains unclear.
The tools we used, in their latest versions, are familiar: OSForensics and FTK Imager.
As expected, OSForensics again delivered the best performance. When we connected the NVMe drive to a USB 4.0 port, the average imaging speed exceeded 1 GB/s (specifically, it reached 1007 MB/s), and the image was completed in just 4 minutes. When the same drive was connected to a USB 3.2 Gen 2 port, the speed dropped by about 1%, indicating that the limiting factor wasn’t the USB port but the adapter used to connect the drive.
In comparison, FTK Imager was considerably slower, taking 7.5 minutes to complete the same task, with an average speed of 525 MB/s, nearly half the rate achieved by OSForensics.
Finally, we tested the performance of our prototype NVMe write-blocker. The results exceeded even our expectations: with full write protection enabled, the copying speed reached 965 MB/s, just 4% slower than when using a standard NVMe adapter without protection.
SATA and NVMe storage devices are the most common types of storage media, apart from USB drives, flash drives, and memory cards used in cameras, dashcams, and smartphones. We plan to address these other storage media soon. Additionally, we are eager to test software-based write blockers, standalone blockers, and to run similar tests in Lunix.
We’ve already discussed the importance of maximizing speeds during forensic analysis; any time saved is truly invaluable. However, achieving high imaging speeds requires the right combination of everything: computers, cables, adapters, write blockers, and even the target storage device all affect the imaging speed.