Investigating 3D Printer Residual Data

TL;DR

This paper explores how 3D printers retain residual data related to print jobs and device activity, highlighting security and forensic implications for investigating additive manufacturing devices.

Contribution

It demonstrates that 3D printers store detailed print process information, including designs and interactions, which can be used for forensic analysis and investigation.

Findings

Devices retain print design and activity data

Comparison of images reveals device usage patterns

Storage patterns can optimize forensic data examination

Abstract

The continued adoption of Additive Manufacturing technologies is raising concerns in the security, forensics, and intelligence gathering communities. These concerns range from identifying and mitigating compromised devices, to theft of intellectual property, to sabotage, to the production of prohibited objects. Previous research has provided insight into the retrieval of configuration information maintained on the devices, but this work shows that the devices can additionally maintain information about the print process. Comparisons between before and after images taken from an AM device reveal details about the device's activities, including printed designs, menu interactions, and the print history. Patterns in the storage of that information also may be useful for reducing the amount of data that needs to be examined during an investigation. These results provide a foundation for future investigations regarding the tools and processes suitable for examining these devices.