Investigating 3D Printer Residual Data
This addresses security and forensics concerns for intelligence and law enforcement communities by enabling detection of compromised devices, intellectual property theft, or prohibited object production, though it is incremental as it builds on prior configuration retrieval research.
The study tackled the problem of retrieving residual data from 3D printers to uncover device activities, revealing that comparisons of before and after images can expose printed designs, menu interactions, and print history, with patterns in data storage potentially reducing investigation data volume.
The continued adoption of Additive Manufacturing technologies is raising concerns in the security, forensics, and intelligence gathering communities. These concerns range from identifying and mitigating compromised devices, to theft of intellectual property, to sabotage, to the production of prohibited objects. Previous research has provided insight into the retrieval of configuration information maintained on the devices, but this work shows that the devices can additionally maintain information about the print process. Comparisons between before and after images taken from an AM device reveal details about the device's activities, including printed designs, menu interactions, and the print history. Patterns in the storage of that information also may be useful for reducing the amount of data that needs to be examined during an investigation. These results provide a foundation for future investigations regarding the tools and processes suitable for examining these devices.