Identifying 3D printer residual data via open-source documentation

Additive manufacturing, also known as 3D printing, is a rapidly growing technology that enables the production of customized complex objects. Its proliferation into both industrial and consumer markets, combined with the potential for misuse, raises questions about how to investigate an incident involving 3D printers. A survey of product documentation acquired from Open Source Intelligence (OSINT) sources reveals patterns in the processes used to print objects with consumer 3D printer models used by 3D object printing services. Both the ability to operate without an attached controlling computer and the methods by which G-code instructions move to the device are identified as features relevant to the potential presence of residual data. The implications of this residual data are discussed within the contexts of digital forensics, intellectual property protection, and privacy. It is concluded that classes of 3D printers are predisposed to containing residual data based on the functionality offered to the user. Additionally, investigations of 3D printers should involve not only the printer itself, but also any devices used in the production or transport of the object design and G-code files in order to develop a comprehensive picture of the events leading to the production of an object.