Degaussing

Tapes and hard drives used for magnetic storage media, record data by using specific magnetic patterns. A read/write head will embed data on spinning platters. The data can be effectively erased through a process called degaussing, which alters the magnetic fields used on the storage device. Whitaker Brothers' Proton T-1 Drawer Degausser is an example of a powerful degaussing device:

A hard drive can be inserted directly into the device, which has a listed processing time of 20 seconds to erase the stored data. A degausser's strong magnetic field will permanently damage the magnetic data on the storage device, either wiping it, or rearranging it into random segments.

New storage drives and tapes will have higher coercivity magnetic values, and correspondingly powerful degaussers are required to render the magnetized data on these devices inaccessible.

A drive that has been degaussed cannot be reused. The process eliminates start-up files, as well as user stored data. Degaussed tapes usually can be re-used.

How to see if you have a hard disk or a SSD

If you are collecting data from a laptop and need to determine if the drive is a hard disk or a solid state drive, you can check using the disk defragmenter tool in Windows.

Simply press the Windows key + R to open run, and then enter: dfrgui.

A window will open that will give you the option to optimize the drive of the PC you are using and all drives which are attached to it. The dialog box will show the media type of the drives:

See the Tip of the NIght for June 11, 2020, for more information on the differences between solid state drives and hard drives.

Forensic Imaging and Write Blocking on NVM Express Drives

As discussed in the Tip of the Night for February 12, 2021, NVM Express allows a computer to communicate with non-volatile memory devices (or solid state drives) which are connected via a PCI express bus ( - a bus being a communication system to transfer data between computers.) Tonight's review of a paper focusing on NVMe technology, Bruce J. Nikkel, NVM Express Drives and Digital Forensics (2016), available at https://digitalforensics.ch/nikkel16.pdf goes into greater detail about this technology.

The NVMe standard is a joint project which includes participants from Cisco, Facebook, Dell, Microsoft, Samsung, Seagate, Western Digital, and other tech companies.

NVMe works with solid state drives that have PCI express slots like this:

Newer SSD drives may have M2 interfaces:

. . . or U2 interfaces.

SSD drives can have these interfaces and not be NVMe based. SSD drives can also use Serial ATA - an older interface. Working with a SATA SSD will slow things down.

Windows and Linux both provide drivers for NVMe.

Some write blockers may not detect NVMe commands, which are not used for SATA or SCSI drives. Since NVME attaches to a PCI express bus, a write blocker designed to act as a bridge between devices can't be used to intercept commands. Write blocking software may be used to modify the NVMe driver. Write blocking software must account for the 64,000 command queues used by NVMe. Older Serial ATA drives only use one command queue.

Forensic imaging of NVMe devices must check for the existence of multiple namespaces. A namespace identifier is used by software to find a device. Removing a namespace can delete evidence sorted on the NVMe drive.

The NVMEe 'Format NVM' command can erase all namespaces on a drive. Entering this simple command for a NVMe drive:

# nvme format /dev/nvme1n1

. . . with the open source NVMe Management Utility (https://nvmexpress.org/open-source-nvme-management-utility-nvme-command-line-interface-nvme-cli/ ) will remove the data that has been written to a NVMe drive.

Access to data on a NVMe drive can also be removed by wiping the encryption keys.