# Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand
## 1 Introduction
The authors [18] carried out a similar study on second-hand hard disks in 2011; however, the current study was carried out on second-hand USB external hard drives by testing all functional requirements as recommended by NIST and evaluating the comparison of the hardware usage and time consumption for the imaging process to identify the best open-source forensic imaging tool currently available. The primary purpose of this research was to evaluate the open-source forensic tools based on the National Institute of Standards and Technology (NIST) Computer Forensics Tool Testing Program (CFTT) framework [10; 11] and to identify their effectiveness. In this research, we purchased 17 USB external hard drives on the TradeMe ([[https://www.trademe.co.nz/](https://www.trademe.co.nz/)]([https://www.trademe.co.nz/](https://www.trademe.co.nz/)), accessed on 7 June 2022) website. Among those, we determined that 15 of the USB hard drives contained sensitive data (e.g., personal info, movies, photos, bank account, and company information) and only two hard drives had securely deleted the data. We categorised the collected data from the USB device's images into various formats e.g., application data, audio, images, messages, text, documents, and video. The findings from this research compared with previous articles discovered similar issues, which is that the remnant data are still available in the second-hand storage devices sold online, and the users are still not aware of the security risk or threats from the data leak. To carry out this study, we developed an experimental setup to discover remnant data from the purchased USB hard drives. We used three open-source digital forensic imaging tools, i.e., DC3 DD ([[http://www.dc3.mil](http://www.dc3.mil)]([http://www.dc3.mil](http://www.dc3.mil)), accessed on 7 June 2022) [19], DCFLDD ([[http://dcfldd.sourceforge.net/](http://dcfldd.sourceforge.net/)]([http://dcfldd.sourceforge.net/](http://dcfldd.sourceforge.net/)), accessed on 7 June 2022) [20], and Guymager ([[http://guymager.sourceforge.net/](http://guymager.sourceforge.net/)]([http://guymager.sourceforge.net/](http://guymager.sourceforge.net/)), accessed on 7 June 2022) [21], to create images from the purchased USB hard drives. We generated four test cases to test the tool functionalities mentioned in the NIST framework (these functionalities are presented in Appendix A). Each test case has its generic procedures, and suitable commands were applied for each forensic tool based on the guideline from the developers to collect accurate information and also to minimise error during the experiment. The selected tools were tested with the same test cases on different purchased USB external hard drives. We note that the Guymager meets most of the tool's functionality requests in all of the tests followed by DC3 DD. The DC3 DD imaging tool had the same functionalities as Guymager; however, the log file generated by DC3 DD was less detailed compared to Guymager. The DCFLDD did not meet many requirements in different test cases, and there was no log file generated by DCFLDD. In addition, among the selected tools, the Guymager imaging tool used most of the hardware resources (i.e., CPU and memory), followed by DC3 DD whereas DCFLDD consumed the fewest resources. The following are the contributions of this work:  
* To exhaustively test the selected open-source forensic imaging tools for fulfilment of the functional and optional requirements of imaging tools based on NIST's CFTT framework, compare the tool's hardware usage and time consumption for the imaging process. * To experimentally acquire the best open-source forensic tools based on the various NIST requirements for forensic investigations. * To understand the level of awareness of users in New Zealand towards the dangers lurking in sensitive data, which can be leaked through the sale of old hard drives. * To summarise several common methods for users and businesses to limit or eliminate potential dangers before selling old hard drives.