NVM express drives and digital forensics

This paper provides an overview of NVME technology and discusses the relevance to the digital forensics community. The NVM Express standard defines an interface and command set for communication between a host and non-volatile memory devices (SSD's). It allows the direct attachment of SSD storage to the PCI Express bus using PCIe slots, M.2, and U.2 interfaces. NVME was developed with a new command set and is not compatible with ATA/ATAPI or SCSI commands. The introduction of NVME to the market creates new challenges when performing digital forensic acquisition and analysis, where legacy drive commands are expected.