# Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand
## 2 Background
### Brief Overview of Selected Forensic Imaging Tools  
In the following, we present a short overview of the forensic tools selected in this work, i.e., DC3 DD, DCFLDD, Guymager. Recall that these open-source tools are widely used for forensic investigations, hence, it is important to experimentally determine the best open-source forensic tools based on various NIST requirements. The DC3 DD ([[https://www.kali.org/tools/dc3](https://www.kali.org/tools/dc3) dd/]([https://www.kali.org/tools/dc3](https://www.kali.org/tools/dc3) dd/), accessed on 7 June 2022) was developed by the Department of Defence Cyber Crime Center based on the original GNU DD source code ([[https://github.com/coreutils/coreutils/blob/master/src/dd.c](https://github.com/coreutils/coreutils/blob/master/src/dd.c)]([https://github.com/coreutils/coreutils/blob/master/src/dd.c](https://github.com/coreutils/coreutils/blob/master/src/dd.c)), accessed on 7 June 2022) with added features for computer forensics, e.g., hashing on the fly with multiple algorithms (MD5, SHA-1, SHA-256, and SHA-512), comprehensive logging information. We found other imaging tools, such as automated image and restore (AIR) ([[https://www.linuxlinks.com/](https://www.linuxlinks.com/)]([https://www.linuxlinks.com/](https://www.linuxlinks.com/))automatedimageandrestore/, accessed on 7 June 2022) that is the graphical version of DC3 DD. The first release of DC3 DD was published in 2008 corresponding to the Coreutils ([[https://www.gnu.org/software/coreutils/](https://www.gnu.org/software/coreutils/)]([https://www.gnu.org/software/coreutils/](https://www.gnu.org/software/coreutils/)), accessed on 7 June 2022). An important characteristic of the DC3 DD is that the patches are automatically updated every time that DD is updated.  
DCFLD ([[http://dcfldd.sourceforge.net/](http://dcfldd.sourceforge.net/)]([http://dcfldd.sourceforge.net/](http://dcfldd.sourceforge.net/)), accessed on 7 June 2022) was developed based on the GNU source code, with modified and upgraded functional components to meet the requirements to become an approved tool for the investigation process. It has several features over the basic DD, e.g., hashing on-the-fly, status output, flexible disk wipes, image/wipe verification, and can send all its log data and output to commands. It has several features that are far more advanced than the DD tool, including its ability to calculate hash values for input data when the process of creating the image is underway, and to create an image after the imaging process by using hash values, and the tool can also split the forensic images or save the output image into many locations [41]. Similarly, the Guymager ([[https://guymager.sourceforge.io/](https://guymager.sourceforge.io/)]([https://guymager.sourceforge.io/](https://guymager.sourceforge.io/)), accessed on 7 June 2022) software is fast, free, and the most user-friendly forensic image tool for media acquisition. This software is designed to support the graphical user interface (GUI) to improve user friendness and help users who do not know how to use the command line. The software was developed based on libewf ([[https://labs.ece.uw.edu/nsl/students/alomair/LB-Arabic/general/forensic-tools/libewf.html](https://labs.ece.uw.edu/nsl/students/alomair/LB-Arabic/general/forensic-tools/libewf.html)]([https://labs.ece.uw.edu/nsl/students/alomair/LB-Arabic/general/forensic-tools/libewf.html](https://labs.ece.uw.edu/nsl/students/alomair/LB-Arabic/general/forensic-tools/libewf.html)), accessed on 7 June 2022) and libguy tools by using a multi-threaded engine which helps computers with multi-processor and hyper-threading hardware support parallel compression for better performance [42].  
Table 2 describes the functionality and differences between the three open-source forensic imaging tools.