# Nintendo 3DS Forensic Examination Tools

Konstantinos Xynos, Huw Read, Iain Sutherland, Matthew Bovee, Trang Do

► To cite this version:

Konstantinos Xynos, Huw Read, Iain Sutherland, Matthew Bovee, Trang Do. Nintendo 3DS Forensic Examination Tools. 19th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2023, Arlington, VA, United States. pp.55-70, 10.1007/978-3-031-42991-0_4 . hal-05517484

HAL Id: hal-05517484

https://inria.hal.science/hal-05517484v1

Submitted on 18 Feb 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Nintendo 3DS Forensic Examination Tools

Konstantinos Xynos¹, Huw Read², Iain Sutherland³, Matthew Bovee², and Trang Do²

¹ Cyber Security Consultant, Stuttgart, Germany

² Norwich University, Northfield, Vermont, USA

hread@norwich.edu

³ Noroff University College, Kristiansand, Norway

**Abstract.** This chapter describes a suite of digital forensic examination tools for the Nintendo 3DS series of game consoles. The Nintendo 3DS is a handheld game console with capabilities that include video recording, photography, web browsing and network communications. Originally released in 2011, the consoles remain popular, with almost 76 million units sold. Since the consoles can enable illegal activities, they are potential containers of evidence in criminal investigations. Previous research has highlighted the artifacts found on Nintendo 3DS and other similar devices. However, this chapter expands the body of research focused on automating artifact extraction and validation. The extraction and validation efforts would be of interest to forensic practitioners as well as researchers focusing on small-scale embedded devices.

**Keywords:** Nintendo 3DS · Game Console · Forensic Examination · Forensic Tools

## 1 Introduction

The Nintendo 3DS is an eighth-generation handheld game console and the immediate predecessor to the Nintendo Switch. Several Nintendo 3DS variants have been released during its production run from 2011 to 2020. The model releases from oldest to most recent are: 3DS, 3DS XL, 2DS, New 3DS, New 3DS XL and New 2DS XL [27]. As of March 2021 almost 76 million Nintendo 3DS consoles have been sold [26, 30]. This figure accounts for 14% of all Nintendo handheld console sales to date.

From a software perspective, 3DS consoles may be categorized as those with the designation “New” and those without the designation (original). Subtle differences exist in the file formats of applications on the two categories of consoles. For example, the modding community has demonstrated differences in the web browser file structure [3]. These and other variations are examined later in this chapter.

Although Nintendo has stopped producing 3DS consoles, the devices continue to be popular. A robust second-hand market exists for “retro” game systems, especially fully-functional old consoles. Searches at online enterprises specializing
in used game consoles show that these systems are plentiful. For example, on
November 1, 2022, more than 6,500 units were on sale on eBay and approximately
10,000 Nintendo 3DS auctions, some for multiple units, were completed during
the previous month.

The nature of Nintendo 3DS devices and their popularity imply that possibilities exist for misuse, which renders them evidentiary sources in digital forensic investigations. In addition to copyright violations, game consoles and their online environments have been the focus of other investigations. In 2019, the FBI sought information from Sony about communications involving a PlayStation user in a drug-related investigation [7]. Mainstream media such as BBC News have highlighted how games can be used to promote extremism [23]. Urquhart [37] describes how game consoles feature prominently in police investigations.

The previous-generation Nintendo DS has featured in a number of criminal
cases. In 2020, evidence of physical abuse of a minor obtained from a Nintendo
DS was relevant in the prosecution of a U.S. Army soldier, who received a life
sentence [12, 29]. Holmes [18] highlighted a case where a Nintendo DS camera
was used for voyeurism. BBC News [6] reported a case where a Nintendo DS was
used to access child abuse material. Sutherland et al. [34] examined the criminal
use of game consoles in the United Kingdom and noted that older consoles still
featured in police investigations.

These and other incidents highlight the risk of purchasing used game consoles
such as Nintendo DS/3DS because the devices may have been used for criminal
purposes and could contain illegal material. Another issue is that older, dis-
continued and unsupported devices may have vulnerabilities that will never be
patched, potentially leading to exposures of personally-identifiable information.
However, because of its continued popularity, Nintendo has continued to release
system updates for the Nintendo 3DS. The latest update (version 11.16.0.49U)
was released in September 2022 [28], two years after 3DS production ended.

The Nintendo 3DS has been the subject of research seeking to identify forensic
artifacts and provide guidance for manual evidence extraction and analysis [31,
32]. However, the research has certain limitations. Although a 3DS NAND dump
is easily mounted as a FAT16 filesystem on a forensic workstation, existing foren-
sic tools are not designed to decode Nintendo 3DS file types. Additionally, man-
ual file and string carving approaches [31] require significant amounts of effort
to extract artifacts from NAND images. This research addresses the limitations
by generating datasets containing Nintendo 3DS artifacts that support empirical
analyses. These datasets facilitated the development and validation of a suite of
automated forensic tools for extracting and analyzing evidence in Nintendo 3DS
console images.

## 2 Previous Research

Previous research has progressed along two paths. The first research path covers first-look methodology development approaches that focus on creating methodologies for manually extracting forensically-important artifacts. For example,
Turnbull [36] conducted a first look of the Nintendo Wii. Xynos et al. [39] provided “suggested basic guidelines” for analyzing Xbox 360 devices. Conrad et al. [9] presented an evidence recovery procedure for the Sony PlayStation 3. Moore et al. [24] described a “preliminary forensic analysis” of the Microsoft Xbox One game console. Davies et al. [11] conducted a first look at the Sony PlayStation 4. Read et al. [32] developed a live forensic acquisition methodology for Nintendo 3DS consoles.

The second research path covers forensic tool development and/or reverse engineering, often after exploits that permit greater filesystem access have been released. Such exploits stemming from greater access often lead to the development of advanced forensic methodologies and tools. For example, Pessolano et al. [31] presented a forensic analysis of the Nintendo 3DS filesystem that leveraged exploits identified by Scires et al. [33]. Commercial forensic tool vendors such as Cellebrite laud such exploit disclosures because they can help law enforcement. Referring to the checkm8/checkra1n exploit [8], Cellebrite [22] stated: “Every now and then, there is a breakthrough that surfaces to help the good guys in the forensic community.”

The last official firmware update for the Nintendo 3DS was released on September 12, 2022 [28]. However none of the updates released by Nintendo since 2018, when Scires et al. [33] publicly documented a boot ROM exploit, have addressed the vulnerability. Because the 3DS system has been discontinued, it is unlikely the vulnerability will never be patched. The Scires et al. [33] exploit is leveraged in this research to create a forensic dump of a 3DS NAND chip (verified by hashes) and to extract the decryption key required to convert the dump to a viable FAT16 image. Given this image, software such as FTK from Exterro (formerly AccessData) can be used to carve the filesystem, extract artifacts from container files and perform keyword searches. Similarly, Barr-Smith et al. [5] leveraged the Fusée Gelée exploit [35] that enabled the analysis of Nintendo Switch NAND dumps and the creation of modules for Autopsy, the popular open-source digital forensic tool.

Forensic analysis and tool development efforts for game consoles have largely been conducted in academia instead of in commercial settings. However, commercial examples do exist. An example is Magnet Forensics Internet Evidence Finder v6.3 [21] that includes tools for Microsoft Xbox 360 analysis. Nevertheless, an extensive literature survey reveals that no open-source or commercial methods or tools are available for Nintendo 3DS devices. Thus, the research described in this chapter stands out in that it addresses the extraction of large portions of the binary data on 3DS devices and its presentation in human-readable reports.

## 3 Toolset Workflow

A Nintendo 3DS console has two key storage components, a NAND memory chip (i.e., eMMC) mounted on a circuit board with up to 2 GB storage capacity (1 GB for the 2DS) and a removable SD or microSD card depending on the model of the console. Read et al. [32] noted that the SD/microSD card can be removed
<figure><img src="image_3.png" /><figcaption>Fig. 1. Toolset workflow.</figcaption></figure>

and analyzed using existing forensic tools. Therefore, the focus of this paper is on evidence contained in the internal NAND memory chip.

Pessolano et al. [31] developed a method for extracting and decrypting NAND chip content in a forensically-sound manner. It is worth noting that successive extractions can be obtained more quickly than the initial extraction. Specifically, the console has a unique encryption key (XORpad file) that is static, and does not change even if the console is formatted. Therefore, after the initial extraction obtains the XORpad key, subsequent extractions only need to extract the NAND content. Pessolano et al. [31] also employed file carving to identify where artifacts are located in a decrypted NAND filesystem. The artifacts tend to reside in containers with DISA and DIFF formats [2]. It is necessary to extract the raw files from their containers before further analysis. The toolset presented in this chapter first extracts files from their DISA/DIFF containers, after which data is extracted from the files.

Figure 1 shows the toolset workflow. Steps A and B correspond to the extraction and decryption procedures documented in [31]. Step C requires a forensic practitioner to load the FAT16 filesystem in the decrypted NAND image on a forensic workstation. Exterro FTK Imager [13] is employed to mount the image. Step D employs a modified version of the 3DS Save Tool [38] with a recursive function that enables all the DISA and DIFF containers to be extracted at once. In Step E, the forensic practitioner specifies the tools to be used for extraction and, by extension, the artifacts to be extracted. The complete list of tools and the artifacts they extract are presented later in Tables 1 and 2.

## 4 Artifact Generation

Validation, which is an essential step when developing digital forensic tools, requires appropriate datasets. Several forensic datasets have been developed for tool validation. Prominent datasets include the Computer Forensics Reference Data Set (CFReDS) [25], Artefact Genome Project (AGP) [17] and Digital Corpora [16].

A search for forensic images related to game consoles using CFReDS resulted in two hits, one from an Xbox 360 (hosted by Digital Corpora) and the other from a PlayStation 3 (actually a capture of the then-supported Linux/Other OS feature instead of the game console filesystem). The AGP dataset did not contain
any game console extractions. Regrettably, no publicly-available Nintendo 3DS datasets were found to support the toolset validation efforts.

The two alternatives were to procure used 3DS consoles and extract their data to create a validation dataset or to create a synthetic dataset from scratch. Employing used consoles was problematic because there would be no guarantees on the quality and quantity of data they contained. Manual analysis would also be required to confirm the presence of artifacts expected to be found by digital forensic tools. Additionally, the used consoles could contain personally-identifiable information that would require additional safeguards.

The alternative promoted by Garfinkel [15] – using “artificially-constructed or fake data” – was selected in this research. Barr-Smith et al. [5] used a similar approach to develop tools for the Nintendo Switch. Specifically, they employed one new device and two used devices to “provide test data for tool development and evaluation.”

A brand-new Nintendo 3DS XL console was procured to create the toolset validation dataset. Artifacts were generated by using the console functions in a controlled manner and meticulously documenting the actions (with timestamps) performed on the console. This led to the creation of a log of all system interactions that could be referenced later to validate that the toolset extracted artifacts correctly. While the process of documenting artifacts was relatively straightforward, decisions had to be made about the artifacts to generate. Fortunately, previous 3DS forensics research conducted by the authors of this chapter [31, 32] provided insights into the artifacts of forensic significance that are accepted by the scientific community. This was bolstered by the collective work of the 3DBrew contributors [1] that provided useful opportunities for exploration.

Generating artifacts on a real system is not without risk; errors can alter the expected results and can lead to extensive tool debugging when the tool was not at fault. Drawing from work with virtualized environments where system snapshots taken earlier are restored at a later stage, Pessolano et al. [31] recommended that initial data captures be restored to confirm the validation results. Therefore, multiple snapshots were taken of the test 3DS console after groups of related artifacts were introduced. For example, web browsing, web history and bookmarks would be considered to be a group of related artifacts.

Figure 2 shows the detailed information required when generating artifacts. The left-hand side of the figure shows samples of successive extractions with indications of their content. The top right-hand side of the figure shows an excerpt from a log generated for the *mydata* structure showing, to the minute, the actions taken on the device. The bottom right-hand side of the figure shows the data retrieved by the forensic tool. Artifact generation involved 16 distinct extractions, each of which was verified forensically using SHA256. The 16 extractions, along with detailed logs of the actions, artifacts and their timestamps, constituted the artificially-generated dataset used for toolset validation.
<figure><img src="image_4.png" /><figcaption>Fig. 2. Detailed information required during artifact generation.</figcaption></figure>

# 5 Forensic Tool Development

Command-line tools were implemented as Python scripts. The individual tools were developed using publicly-available information about the binary file formats found at 3DBrew [1] along with additional structures that were identified during tool development. The Python scripts leveraged the defined data structures to interpret the extracted data. The information about the Nintendo 3DS filesystem provided at 3DBrew served as an excellent resource for tool development, especially information pertaining to filesystems, file formats and diverse metadata. However, as the materials posted at 3DBrew do not appear to have been peer reviewed, it would be improper to take them at face value. Therefore, regardless of source, all the forensics tools described in this work underwent a thorough validation process described in Section 6.

Publicly-available information and a verifiable testing process were used to desynchronize binary data describing the data structures and obtain the relevant information. Figure 3 shows information obtained about the Wi-Fi settings. The top of the figure shows a portion of the network data structure. The bottom of the figure shows that the structure was reused in three blocks. Figure 8 later in this chapter shows the resulting extraction.

The toolset created in this research comprises 16 tools (scripts) that automate the extraction and reporting of artifacts in Nintendo 3DS consoles. The tools can be executed together to batch-process evidence extractions. Tables 1 and 2 describe the tools and the artifacts they recover. Each tool accepts as input the path of the file to be processed. The script processes the binary data and extracts information that is correctly defined in the data structures and presents it in human-readable form.

The tools are designed to be verbose in that they parse and extract more information than is presented. For example, many of the artifacts listed in Ta-
<figure><img src="image_5.png" /><figcaption>Fig. 3. Extracted Wi-Fi settings information.</figcaption></figure>

bles 1 and 2 have accompanying metadata that is extracted. Only summary details of the artifacts are presented to enhance readability and adhere to the space constraints.

Figure 4 demonstrates the process of launching the toolset. Although each tool may be executed individually, all the tools are collectively incorporated in a single front-end application named 3ds-one-script-to-rule-them-all.py. Upon invoking the help function (-help), a list of individual tools and their corresponding artifacts with their filesystem locations are displayed. Figure 4 also shows that the same scripts are executed for localizations of the same data. For example, gameplay(us/eu) is stored in different locations, but the binary format is the same.

# 6 Toolset Validation

Figure 5 shows toolset validation workflow. In the iterative workflow, the five steps are repeated for each tool in the toolset until all the tools are validated.

- Step A. Restore Extraction to 3DS: This step has been demonstrated to be forensically sound by Pessolano et al. [31] who restored a NAND dump extraction, reimaged and compared hashes to the previous image and found the two hashes to be identical. Pessolano and colleagues noted the date and time had to be set correctly on the console after restoring an extraction. For example, the pedometer did not display the step counts until the date process was corrected (Figure 6).
<table><caption>**Table 1.** Summary of artifacts recovered by tools.</caption><thead><tr><td>Tool</td><td>Description</td><td>Artifacts Recovered</td></tr></thead><tbody><tr><td>account-extractor</td><td>Prints out the principal ID and information related to online authentication</td><td>Local friend code, NEX password, principal ID, principal ID HMAC</td></tr><tr><td>config-extractor</td><td>Extracts parental settings, (including PIN set by parent, email and the secret), Wi-Fi settings, username, birthday, state and coordinates</td><td>Parental controls, Wi-Fi settings, cleartext password, username, birthday, state, coordinates</td></tr><tr><td>cookies-and-bookmarks-extractor</td><td>Extracts bookmark and cookie information</td><td>Bookmarks (description, URL default), creation time, cookie information</td></tr><tr><td>mii-extractor</td><td>Extracts Mii character information, Mii name, author name, system ID and MAC address where it was created, descriptive Mii information</td><td>Mii entry number, Mii name, Mii author name, Mii ID, system ID, MAC address, Mii birthday, Mii gender</td></tr><tr><td>mydata-extractor</td><td>Extracts information from mydata file, serial number, display name, personal message</td><td>Serial number, display name, Mii data (similar to mii-extractor), personal message</td></tr><tr><td>amiibo-parser</td><td>Parses amiibo (not on a 3DS device) data extracted from a tag and presents the owner(s), date changes and amiibo settings</td><td>Amiibo owner, second owner, setup date, last write date, write counter, game ID, model number</td></tr><tr><td>blocklist-extractor</td><td>Extracts usernames blocked by console owner</td><td>Blocked usernames</td></tr><tr><td>exbanner-extractor</td><td>Extracts messages stored in exbanner files</td><td>Texture names, messages</td></tr><tr><td>friendlist-extractor</td><td>Extracts a list of friends, including display name and personal message, Mii data section and details about the friend entries</td><td>Friend display name, personal message, Mii data (similar to mii-extractor), friend details (country, area, language, platform)</td></tr><tr><td>gamecoin-extractor</td><td>Parses gamecoin.dat file, extracts the number of play coins, last update date</td><td>Total coins, coins on date, step count for new coin, step count for last coin</td></tr></tbody></table>
<table><caption>**Table 2.** Summary of artifacts recovered by tools (continued).</caption><thead><tr><td>Tool</td><td>Description</td><td>Artifacts Recovered</td></tr></thead><tbody><tr><td>gamernote-<br>process-<br>external-<br>memo-folder</td><td>Recursively processes folder where gamernotes are stored, references gamernote-process-external file</td><td>Shim to recursively process gamernotes</td></tr><tr><td>gamernote-<br>process-<br>external</td><td>There are 16 gamernotes, unused ones appear as white images</td><td>Images and thumbnails in PNG format</td></tr><tr><td>gameplay-<br>extractor</td><td>Shows game title ID and total played, times played, when title was first and last played</td><td>Game title ID, total played, times played, first played, last played</td></tr><tr><td>pedometer-<br>extractor</td><td>Shows number of steps registered by console and timestamps</td><td>Hourly, daily, monthly, yearly step counts, timestamps, last update</td></tr><tr><td>playhistory-<br>extractor</td><td>Extracts play history, including title ID, possibly title name</td><td>Title ID, title name</td></tr><tr><td>streetpass-<br>cec-<br>extractor</td><td>Extracts StreetPass containers, inbox and outbox messages</td><td>StreetPass messages, send method, message state, send/forward count</td></tr></tbody></table>

<figure><img src="image_6.png" /><figcaption>**Fig. 4.** Artifact locations in the filesystem.</figcaption></figure>
<figure><img src="image_7.png" /><figcaption>Fig. 5. Toolset validation workflow.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 6. Live analysis to minimize errors in log notes.</figcaption></figure>

- **Step B. Compare Log Notes Against Console Menus:** Live analysis is performed on the running console to identify errors (Figure 6). The native 3DS operating system applications are used to interpret data, following which on-screen values are compared against the log notes.

* (i) *If Log Notes Differ from Console Menu, Update Log:* If the log notes differ from a console menu, the log notes are updated to reflect what was shown on the console. The same image is restored to the 3DS device (Step A) and checked a second time (Step B). This ensures that the log notes are consistent with image content.

- **Step C. Execute Tool on Decrypted Filesystem:** This step is geared toward a particular tool. After filesystem extraction in the toolset workflow in Figure 1 is completed, the tool is executed taking care to provide the correct path/file as input (Figure 4).
<figure><img src="image_9.png" /></figure>

13:40 - imaged sd card

22:09 steps - total to this point: 4581. 12/29/2020 - 4,578 (9am 10am 11am most active),
12/28 - 3 (11:30ish?)

imaged - 29122020_b_accurate_steps_pedometer
observations in pedometer.dat

bytes[0-3]: unknown, always 01000000?

bytes[4:5] - total steps recorded so far (little endian)

<figure><img src="image_10.png" /><figcaption>Fig. 7. Successful comparison of tool output against log notes.</figcaption></figure>

- **Step D. Compare Tool Output Against Log Notes:** Since the log entries are formally validated against the console (Step B), any difference between the tool output and log notes indicates misinterpretation by the tool that must be resolved. Figure 7 shows an example of a successful comparison. The top image shows the log notes and the bottom image shows the *pedometer-extractor* tool output, which exhibits consistent values.

* (ii) *If Log Notes Differ from Output, Update Tool:* The application is updated to display the same information that appears on the console. Differences may occur due to programming errors (bugs), logical errors (from third parties) and/or formatting errors (e.g., 3DS timestamp is DD/MM/YYYY instead of MM/DD/YYYY [USA format]).

- **Step E. Identify Next Tool to Validated:** After a tool has been validated and its output is consistent with the log notes (and console, by association), the next tool is validated starting with Step A in the tool validation workflow.
<figure><img src="image_11.png" /><figcaption>Fig. 8. Recoverable and unrecoverable plaintext Wi-Fi passphrase.</figcaption></figure>

# 7 Observations

The Nintendo 3DS is a fairly complex device with a number of artifacts of significance in forensic investigations. Tables 1 and 2 present details about artifacts recovered by the tools. However, it is pertinent to make observations about five tools:

- **pedometer-extractor**: The pedometer data in the Activity Log application was decoded to reveal the number of steps recorded by the device on an hourly basis. Figure 7 shows the validation of the console details.

- **config-extractor**: A 3DS device stores a maximum of three Wi-Fi access points. Figure 8 shows that the Wi-Fi passphrase is recoverable as plaintext using the tool (left-hand side) but is not recoverable via the native 3DS graphical user interface (right-hand side).

- **cookies-and-bookmarks-extractor**: 3DBrew [3] reveals that 3DS devices with the moniker "New" (e.g., New Nintendo 2DS XL) store browser files in certain locations whereas 3DS devices without the moniker store browser files based on region. The tool identifies console type according to folder structure and file location (Figure 4) when extracting browser history and bookmarks, displaying URL, timestamp and cookie data.

- **mydata-extractor**: As shown in Figure 9, the tool extracts the console MAC address, serial number, personal message, etc. Although a sticker with the serial number is located on the rear of the console, the tool output provides an opportunity to identify the system should the sticker be removed or the printed serial number become illegible.

- **friendlist-extractor**: A fictitious friend profile was created on a formatted second 3DS device and the users on the first and second devices befriended each other. Figure 10 shows that the tool displays the creator's MAC address, providing a tangible link (and possibly, probable cause) between devices. The script also shows the friend's name, birthday and gender.
<figure><img src="image_12.png" /><figcaption>Fig. 9. Validation of console details.</figcaption></figure>

<figure><img src="image_13.png" /><figcaption>Fig. 10. MAC address of Mii creator and Mii representation.</figcaption></figure>

## 8 Toolset Evaluation

The focus of this work was to facilitate authorized forensic examinations of 3DS consoles. This has been accomplished by developing tools that expedite the extraction of many types of 3DS artifacts. Whereas previous work [31] provided access to seven types of 3DS artifacts, the toolset presented in this chapter almost doubles the available artifact types. Additionally, it acquires artifacts from binaries and provides the convenience of batch-processing 3DS device evidence extraction and consolidating the findings in a single report.

The toolset leverages an exploit identified by Scires et al. [33] that was reported in the public domain nearly five years ago [1–3, 31, 33]. The exploit could be leveraged to circumvent copyright protection in video games. Unfortunately, the most recent firmware update, released nearly four years after the exploit became public, does not address the vulnerability. The authors of this chapter neither imply that Scires and colleagues developed the exploit for nefarious purposes nor do they condone the use of the exploit for nefarious purposes. Nevertheless, should the vulnerability remain unpatched, it benefits authorized entities to leverage the exploit and toolset in official investigations.
The toolset is available only to law enforcement and other legitimate users by contacting the lead author of this chapter. However, caution is advised when using the toolset and its outputs. Variations in hardware releases in different countries have been noticed and may persist. Forensic practitioners should follow best practices [4, 14, 20], admissibility guidelines such as the Daubert standard [19] and/or criminal procedure rules and practice directions [10] to properly validate the toolset outputs. Tool errors or omissions should also be reported to the lead author.

Statistics and feedback on toolset usage in live investigations provide opportunities to advance the validation of the toolset. Unfortunately, the opportunities may be limited because the investigative community (law enforcement and intelligence agencies) are reluctant to share usage statistics and, in some cases, even mention that game consoles are being examined [34]. This situation presents challenges to the effective validation of this toolset and others like it.

## 9 Conclusions

The functionality and widespread use of game consoles renders them potentially valuable sources of evidence in forensics investigations. This is true for older consoles that are no longer manufactured, but are still popular in the second-hand market. Forensic research on these consoles tends to start as initial explorations of the consoles soon after they are released, followed by in-depth research into the extraction and analysis of forensic artifacts. This two-stage approach, focused on enabling access to console content and the subsequent forensic analysis and presentation of artifacts in human-readable form, can extend over several years, delaying the development of tools for conducting forensic investigations.

The Nintendo 3DS console is a discontinued, albeit still popular, game console. The bespoke Nintendo 3DS suite of tools developed in this research facilitates the expeditious extraction and analysis of artifacts from the NAND memory chip, the primary 3DS evidence repository. The diverse artifacts extracted include usernames, Mii (avatar) names, network SSIDs, passphrases and numerous dates and timestamps. The scripted tools have verbose outputs for debugging purposes and to assist in identifying variations between different 3DS models.

Toolset enhancements will include a module that enables options for verbose, summary and machine-readable outputs of key evidentiary items. Additionally, research will focus on understanding the variations in evidentiary items between devices with and without SD card memory.

**Acknowledgment** This research was supported by the National Science Foundation under Grant no. DGE 1754014.

## References

1. 3DBrew, Flash Filesystem (www.3dbrew.org/wiki/Flash_Filesystem, February 7, 2017.)
2. 3DBrew, DISA and DIFF (www.3dbrew.org/wiki/DISA_and_DIFF), January 2, 2020.

3. 3DBrew, Internet Browser (www.3dbrew.org/wiki/Internet_Browser), March 11, 2023.

4. A. Arshad, A. Jantan and O. Abiodun, Digital forensics: Review of issues in the scientific validation of digital evidence, *Journal of Information Processing Systems*, vol. 14(2), pp. 346–376, 2018.

5. F. Barr-Smith, T. Farrant, B. Leonard-Lagarde, D. Rigby, S. Rigby and F. Sibley-Calder, Dead man's switch: Forensic autopsy of the Nintendo Switch, *Digital Investigation*, vol. 36(S), article no. 301110, 2021.

6. BBC News, Special Olympics winner caught with abuse images for second time, August 30, 2021.

7. B. Brousil, Affidavit in Support of Search Warrant, Case No. 19SW-00364-JTM, United States District Court for the Western District of Missouri, Kansas City, Missouri (s3.cloudappengine.org/documents/6565970/PlayStation-Seach-Warrant-Application.pdf), October 22, 2019.

8. checkra1n Developers, checkra1n: Jailbreak for iPhone 5s through iPhone X, iOS 12.0 and up (checkra.in), 2023.

9. S. Conrad, G. Dorn and P. Craiger, Forensic analysis of a PlayStation 3 console, in *Advanced in Digital Forensics VI*, K. Chow and S. Shenoi (Eds.), Springer, Berlin Heidelberg, Germany, pp. 65–76, 2010.

10. Criminal Procedure Rule Committee, Criminal Procedure Rules and Practice Directions 2020, Ministry of Justice, London, United Kingdom (www.gov.uk/guidance/rules-and-practice-directions-2020), 2020.

11. M. Davies, H. Read, K. Xynos and I. Sutherland, Forensic analysis of a Sony PlayStation 4: A first look, *Digital Investigation*, vol. 12(S1), pp. S81–S89, 2015.

12. C. Duncan, Fort Bragg soldier sexually abused adopted children for years, FBI says, *The News and Observer*, April 24, 2019.

13. Exterro, FTK Imager, Portland, Oregon (www.exterro.com/ftk-imager), 2023.

14. Forensic Science Regulator, Forensic Science Regulator Guidance: Method Validation in Digital Forensics, FSR-G-218, Issue 2, London, United Kingdom, 2020.

15. S. Garfinkel, Lessons learned writing digital forensics tools and managing a 30 TB digital evidence corpus, *Digital Investigation*, vol. 9(S), pp. S80–S89, 2012.

16. S. Garfinkel, P. Farrell, V. Roussev and G. Dinolt, Bringing science to digital forensics with standardized forensic corpora, *Digital Investigation*, vol. 6(S), pp. S2–S11, 2009.

17. C. Grajeda, L. Sanchez, I. Baggili, D. Clark and F. Breitinger, Experience constructing the Artifact Genome Project (AGP): Managing the domain's knowledge one artifact at a time, *Digital Investigation*, vol. 26(S), pp. S47–S58, 2018.

18. W. Holmes, Blackpool child rapist tries to use secret Nintendo DS camera to record people on toilet two months after release, *Blackpool Gazette*, February 20, 2020.

19. Legal Information Institute, Daubert Standard, Cornell Law School, Ithaca, New York (www.law.cornell.edu/wex/daubert_standard), 2022.

20. J. Lyle, B. Guttman, J. Butler, K. Sauerwein, C. Reed and C. Lloyd, Digital Investigation Techniques: A NIST Scientific Foundation Review, NISTIR 8354-Draft, National Institute of Standards and Technology, Gaithersburg, Maryland, 2022.

21. Magnet Forensics, Magnet Forensics releases Internet Evidence Finder v6.3, Waterloo, Canada (investors.magnetforensics.com/news/press/news-details/2014/Magnet-Forensics-Releases-Internet-Evidence-Finder-v63/default.aspx), February 5, 2014.
22. H. Mahalik, S. Tal, G. Rutenberg and R. Arato, checkm8 and checkrain - Full Filesystem Extractions for iOS Devices, Webinar, Petah Tikva, Israel (cellebrite.com/en/checkm8-and-checkrain-full-filesystem-extractions-for-ios-devices), 2023.

23. C. Miller and S. Silva, Extremists using video-game chats to spread hate, *BBC News*, September 23, 2021.

24. J. Moore, I. Baggili, A. Marrington and A. Rodrigues, Preliminary forensic analysis of the Xbox One, *Digital Investigation*, vol. 11(S2), pp. S57-S65, 2014.

25. National Institute of Standards and Technology, Computer Forensic Reference Data Set Portal, Gaithersburg, Maryland (cfreds.nist.gov), 2023.

26. Nintendo, Dedicated Video Game Sales Units, Kyoto, Japan (www.nintendo.co.jp/ir/en/finance/hardSoft/index.html), December 31, 2022.

27. Nintendo, Nintendo 3DS Family, Windsor, United Kingdom (www.nintendo.co.uk/Hardware/Nintendo-3DS-Family/Nintendo-3DS-Family-94560.html), 2023.

28. Nintendo, System Menu Update History, Redmond, Washington (en-americas-support.nintendo.com/app/answers/detail/a_id/231/~/system-menu-update-history), 2023.

29. Office of Public Affairs, U.S. Department of Justice, U.S. Army soldier sentenced to life in prison for aggravated sexual assault, Washington, DC (www.justice.gov/opa/pr/us-army-soldier-sentenced-life-prison-aggravated-sexual-assault), July 8, 2020.

30. T. Owens, Unit sales of Nintendo's home consoles from 1997 to 2021 (in millions), Statista, New York (www.statista.com/statistics/227012/lifetime-unit-sales-of-nintendos-home-consoles), August 11, 2022.

31. G. Pessolano, H. Read, I. Sutherland and K. Xynos, Forensic analysis of the Nintendo 3DS NANO, *Digital Investigation*, vol. 29(S), pp. S61-S70, 2019.

32. H. Read, E. Thomas, I. Sutherland, K. Xynos and M. Burgess, A forensic methodology for analyzing Nintendo 3DS devices, in *Advances in Digital Forensics XII*, G. Peterson and S. Shenoi (Eds.), Springer, Cham, Switzerland, pp. 127-143. 2016.

33. M. Scires, M. Mears, D. Maloney, M. Norman, S. Tux and P. Munroe, Attacking the Nintendo 3DS boot ROMs, arXiv: 1802.00359v2 (arxiv.org/abs/1802.00359), 2018.

34. I. Sutherland, H. Read and K. Xynos, An analysis of the prevalence of game consoles in criminal investigations in the United Kingdom, *Proceedings of the Twenty-Fifth European Conference on Cyber Warfare and Security*, pp. 289-295, 2022.

35. K. Temkin, FAQ: Fusée Gelée (www.ktemkin.com/faq-fusee-gelee), April 4, 2018.

36. B. Turnbull, Forensic investigation of the Nintendo Wii: A first glance, *Small Scale Digital Device Forensics Journal*, vol. 2(1), pp. 1-7, 2008.

37. L. Urquhart, U.S. police use game consoles in crime investigations, *Naked Security by Sophos*, January 26, 2012.

38. W. Wang, 3DS Save File Extraction Tools, GitHub (github.com/wwylele/3dsSaveTool), 2023.

39. K. Xynos, S. Harries, I. Sutherland, G. Davies and A. Blyth, Xbox 360: A digital forensic investigation of the hard disk drive, *Digital Investigation*, vol. 6(3-4), pp. 104-111, 2010.