Investigating Digital Forensic Artifacts Generated from 3D Printing Slicing Software: Windows and Linux Analysis

Although Three-dimensional (3D) printers have legitimate applications in various fields, they also present opportunities for misuse by criminals who can infringe upon intellectual property rights, manufacture counterfeit medical products, or create unregulated and untraceable firearms. The rise of affordable 3D printers for general consumers has exacerbated these concerns, making it increasingly vital for digital forensics investigators to identify and analyze vital artifacts associated with 3D printing. In our study, we focus on the identification and analysis of digital forensic artifacts related to 3D printing stored in both Linux and Windows operating systems. We create five distinct scenarios and gather data, including random-access memory (RAM), configuration data, generated files, residual data, and network data, to identify when 3D printing occurs on a device. Furthermore, we utilize the 3D printing slicing software Ultimaker Cura version 5.7 and RepetierHost version 2.3.2 to complete our experiments. Additionally, we anticipate that criminals commonly engage in anti-forensics and recover valuable evidence after uninstalling the software and deleting all other evidence. Our analysis reveals that each data type we collect provides vital evidence relating to 3D printing forensics.