# Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand
## 6 Related Work
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Articles** & **Commercial Tools** & **Free Tools** & **Open-Source Tools** \\ \hline
[44] & EnCase (version 6.8) & N/A & LinEn (version 6.1) \\ \hline
[13] &
\begin{tabular}{l} Helix3 Pro, Automated Image \\ and Restore (AIR) (version 2.0.0) \\ \end{tabular} & FTK Imager (version 2.90) & \\ \hline
[52] &
\begin{tabular}{l} X-Ways Forensics (version 16.2 \\ SR-5) \\ \end{tabular} & N/A \\ \hline
[53] &
\begin{tabular}{l} Image MASAfter Solo-4 Forensic \\ \end{tabular} & N/A \\ \hline
[54] & \
\begin{tabular}{l} Fast Disk Acquisition System \\ (FDAS) (version 2.0.2) \\ \end{tabular} & \multirow{2}{*}{N/A} & \multirow{2}{*}{
\begin{tabular}{l} DCFLDD (version 1.3.4-1) \\ \end{tabular} } \\ \cline{1-1} \cline{3-4}
[14] & EnCase (version 7.04.01) &
\begin{tabular}{l} FTK Imager (version 3.1.1.8), \\ SANS SIFT Workstation \\ (version 2.14) \\ \end{tabular} & N/A \\ \hline
[12] &
\begin{tabular}{l} Forensic Toolkit (version 5.1), \\ EnCase (version 7.05.01), \\ Paladin (version 4.0) \\ \end{tabular} & FTK Imager (version 3.1.4), \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The digital forensic tools tested by previous works for various functionality. Many researchers studied remnant data on storage devices purchased from the second-hand market, e.g., in the United Kingdom (UK), North America, Germany, France [22], the United Arab Emirates (UAE) [8], Indonesia [7], Australia [6] and New Zealand [18]. The authors in [7; 8] used devices provided by the supplier which were marked with a unique serial number, ensuring that the researchers could not determine how or where the devices were purchased. Other researchers purchased second-hand storage devices from online auction websites within the same country. The authors in [6; 36; 58] used different accounts to buy the memory cards and USB thumb drives from different sellers to prevent anybody from detecting an ongoing investigation and also to avoid unintended effects if someone wanted to change or influence the results of the research. After collecting storage devices, the researchers created the images of all devices by using a variety of open-source and commercial forensic imaging tools. The acquisition tools used in their studies included FTK Imager (version 1.42 to 3.4.1) ([7; 36; 3]), Encase imager (version 7.10) ([34]), X-ways (version 18.8) ([34]) and Tableau TD1 ([18]). The images were then securely stored to ensure confidentiality. Few works have studied searching for remaining data in second-hand storage devices and understanding the process and tools used by the previous researchers in their experiments. For example, the authors in [15] examined the second-hand 43 old USB thumb drives, purchased over the eBay website in England, for remaining data and the level of security risks based on the examined data. The authors used different types of forensic tools, such as Forensic Tool Kit (FTK), to create images of the USB devices, and Autopsy (version 2.08) and Helix software (Linux based) were used to analyse the created images. The authors in [22] analysed different hard drivers (e.g., 174 hard drives from the UK, 74 hard drives from North America, 39 hard drives from Germany, 17 hard drives from France, and 42 hard drives from Australia) by using an authenticated tool such as Autopsy (version 2.2.4) and the Sleuth Kit (version 3.1.3). Similarly, other works [6; 7; 8; 16; 8; 36] use evaluate different types of secondary storage devices by first creating their images, and analysed them for sensitive information using various forensic tools. Hence, we note that very limited works [12; 13; 14] carried out an in-depth evaluation of free, commercial, and open-source imaging forensic tools. In addition, the majority of the works did not fully evaluate the functional and optional requirements of imaging tools based on the NIST CFTT framework (see Appendix A). For example, [PERSON] and [PERSON] [14] tested four functions such as 'DI-RM-01', 'DI-RM-02', 'DI-RM-04' and 'DI-RM-08' (as shown in Appendix A).