1

I am looking into M.2 docking stations such as the Maiwo K3016S as shown below.

enter image description here

Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order to make forensic images of (Bitlocker encrypted) M.2 disks? I assume that when Bitlocker software encryption is used it should be possible but when Bitlocker is managing SED hardware-encryption (with TPM) it might not be possible. Is this assumption correct and what are alternative methods to image (Bitlocker) (encrypted) M.2 disks, preferably without expensive hardware imagers?

Lastly, can an (encrypted) M.2 disk be safely removed from, externally imaged and reinstalled to the host while retaining its exact original function?

Bob Ortiz
  • 6,234
  • 8
  • 43
  • 90
  • The issue here seems not the M.2 so much as the Bitlocker-managed SED functionality. That will ruin your day equally on a SATA drive. But, yes — as for the question of imaging, the "dedicated imagers" are basically just a really expensive "Certified" combo dock-and-write-blocker. The drive should be none the wiser after being cloned. – JamesTheAwesomeDude Feb 25 '21 at 22:44

1 Answers1

1

The "docking station" you're describing seems to primarily be a cloner, a tool that duplicates the data on one device to another. It shouldn't write anything to the "Source" disk by itself, though for forensic purposes you might want one that explicitly and legally-enforcibly guarantees not to write to the source.

Conventionally, BitLocker just replaces the volume metadata (where file system info is usually stored) with its own metadata (about key protectors and such, plus where the actual file system metadata was moved to). You can think of this as being like "formatting" the disk with BitLocker. Cloning that is easy; the cloner doesn't know anything about the data it is copying and it's not like it understands actual file systems either.

Self-Encrypting Drives configured to require an Authorization Key are another story. It doesn't matter whether the drive uses BitLocker or some other way to control the SED. Nor does it matter whether it's M.2 NVMe, other PCIe, conventional 2.5" SATA, or any other interface. The drive firmware will refuse to allow I/O until the correct AK is provided, and the cloner probably can't do that (unless there's some way for a PC to supply it).


You seems to be ascribing various properties to M.2 disks, but that's not really warranted. First of all, M.2 is a family of physical interfaces; the actual data on the pins might be either SATA or PCIe (specifically, NVMe, which is a standard for PCIe flash storage interfacing). While the exact commands to do things (read, write, delete, etc.) are different between the various communication protocols, they all conceptually do the same thing. It is possible, but not necessary (or, AFAIK, common), for any disk to do things like maintain a log of every time it powers on, or how many bytes are read or written or whatever. None of that has to do with using an M.2 form factor vs. any other. In general, anything you know about 2.5" SATA disks will almost certainly be true for M.2 SATA disks, and probably true for NVMe ones too.

CBHacking
  • 40,303
  • 3
  • 74
  • 98