±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 33165
New Yesterday: 2 Visitors: 207

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

3D-printers and digital traces?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

3D-printers and digital traces?

Post Posted: Wed Dec 06, 2017 6:05 am

I'm looking into what digital traces are left behind when using 3D-printers, especially on computers and units (like memory cards) used in slicing and transferring 3D-models to the printers.

I have tried Googling this topic but only found references to _using_ 3D-printers in forensic work, almost nothing on useful file carvers, methods etc.

This will of course mostly be the usual file forensic work we do every day, but before I dig into that I figured it would be nice to see what others have done.

So, with the risk of getting mercilessly mocked for my lack of Google Fu, have anyone else here seen some information on this particular topic?

/J  

Jofre
Member
 
 
  

Re: 3D-printers and digital traces?

Post Posted: Wed Dec 06, 2017 2:18 pm

- Jofre

So, with the risk of getting mercilessly mocked for my lack of Google Fu, have anyone else here seen some information on this particular topic?

/J

Did you consider the risk of being mocked not for your lack of Google Fu, but rather for the excessive narrowness of the topic? Question

Seriously, what normally happens is that some data is transferred from a computer to the (usually on-board) controller of the 3D printer, this usually can happen:
1) via Ethernet (not very common)
2) via Wi-FI (directly or through - say - Octoprint or similar)
3) via USB
4) via physically transferring a SD card written on the PC to the 3d printer controller

#1 happens usually via browser or from a dedicated program, so it doesn't differ much from *any* network connection forensics
#2 as above
#3 happens usually communicating via a (virtual) COM
#4 is nothing different from *any* forensic investigation on *any* SD card

In all of these cases the PC will likely have traces of the slicing software and/or some 3D Cad/modeler, etc.
#1 may have the usual web artifacts
#2 as above + connection to the Wi-Fi of the printer
#3 will have traces of the installation of an otherwise normally uncommon) virtual com port on USB , often using the FTDI drivers
#4 is just a FAT (usually 32) SD filesystem/volume there is nothing in there (that I know of) that can link a given PC to a given printer, AFAICT/AFAICR the SD is generally mounted (on the printer) as Read Only, but I guess it depends on the specific printer controller and on the specific firmware.
In any case all that normally goes on a SD card is G-code, so it is "plain text" with usually very short sentences (i.e. lots of newlines) and lots, really lots of G's, M's, X's, Y's and Z's Wink so even if specific files may not be recoverable by name, even partial recovery can be made, though a number of printers will have on board (example) the Repetier firmware, and thus the files may be binary.

Since most printers are Arduino (or Arduino clone) based, maybe you can find something of interest looking for "arduino forensics", but that will probably be limited to the "base" Arduino and not the specific board (including the SD card "shield", external or "embedded").

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: 3D-printers and digital traces?

Post Posted: Wed Dec 06, 2017 2:20 pm

Not! about 3D printers - but may for your printer collection Smile An old but worth reading doc with valuable book references

sci-hub.bz/10.1109/MSP.2008.931082  

RolfGutmann
Senior Member
 
 
  

Re: 3D-printers and digital traces?

Post Posted: Thu Dec 07, 2017 8:34 am

- jaclaz

Did you consider the risk of being mocked not for your lack of Google Fu, but rather for the excessive narrowness of the topic? Question


I'll take getting mocked any day if I gain some knowledge in the deal. Wink

Thanks for your answer. Jaclaz!  

Jofre
Member
 
 

Page 1 of 1