3D-printers and dig...
 
Notifications
Clear all

3D-printers and digital traces?

4 Posts
3 Users
0 Likes
1,148 Views
Jofre
(@jofre)
Posts: 10
Active Member
Topic starter
 

I'm looking into what digital traces are left behind when using 3D-printers, especially on computers and units (like memory cards) used in slicing and transferring 3D-models to the printers.

I have tried Googling this topic but only found references to _using_ 3D-printers in forensic work, almost nothing on useful file carvers, methods etc.

This will of course mostly be the usual file forensic work we do every day, but before I dig into that I figured it would be nice to see what others have done.

So, with the risk of getting mercilessly mocked for my lack of Google Fu, have anyone else here seen some information on this particular topic?

/J

 
Posted : 06/12/2017 12:05 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

So, with the risk of getting mercilessly mocked for my lack of Google Fu, have anyone else here seen some information on this particular topic?

/J

Did you consider the risk of being mocked not for your lack of Google Fu, but rather for the excessive narrowness of the topic? ?

Seriously, what normally happens is that some data is transferred from a computer to the (usually on-board) controller of the 3D printer, this usually can happen
1) via Ethernet (not very common)
2) via Wi-FI (directly or through - say - Octoprint or similar)
3) via USB
4) via physically transferring a SD card written on the PC to the 3d printer controller

#1 happens usually via browser or from a dedicated program, so it doesn't differ much from *any* network connection forensics
#2 as above
#3 happens usually communicating via a (virtual) COM
#4 is nothing different from *any* forensic investigation on *any* SD card

In all of these cases the PC will likely have traces of the slicing software and/or some 3D Cad/modeler, etc.
#1 may have the usual web artifacts
#2 as above + connection to the Wi-Fi of the printer
#3 will have traces of the installation of an otherwise normally uncommon) virtual com port on USB , often using the FTDI drivers
#4 is just a FAT (usually 32) SD filesystem/volume there is nothing in there (that I know of) that can link a given PC to a given printer, AFAICT/AFAICR the SD is generally mounted (on the printer) as Read Only, but I guess it depends on the specific printer controller and on the specific firmware.
In any case all that normally goes on a SD card is G-code, so it is "plain text" with usually very short sentences (i.e. lots of newlines) and lots, really lots of G's, M's, X's, Y's and Z's wink so even if specific files may not be recoverable by name, even partial recovery can be made, though a number of printers will have on board (example) the Repetier firmware, and thus the files may be binary.

Since most printers are Arduino (or Arduino clone) based, maybe you can find something of interest looking for "arduino forensics", but that will probably be limited to the "base" Arduino and not the specific board (including the SD card "shield", external or "embedded").

jaclaz

 
Posted : 06/12/2017 8:18 pm
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

Not! about 3D printers - but may for your printer collection -) An old but worth reading doc with valuable book references

https://sci-hub.bz/10.1109/MSP.2008.931082

 
Posted : 06/12/2017 8:20 pm
Jofre
(@jofre)
Posts: 10
Active Member
Topic starter
 

Did you consider the risk of being mocked not for your lack of Google Fu, but rather for the excessive narrowness of the topic? ?

I'll take getting mocked any day if I gain some knowledge in the deal. 😉

Thanks for your answer. Jaclaz!

 
Posted : 07/12/2017 2:34 pm
Share: