# Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand
## 5 Discussion
### Findings of Evaluated Forensic Imaging Tools  
This section discusses and compares the performance data collected from the experiments of the three selected forensic tools that are best suited for investigating remnant data present in second-hand USB storage devices. **Test Case FIT-ID-01**: For this test case, we note that the DC3 DD and DCFLDD tools successfully passed all the functional requirements, as presented in Table 5. However, the DCFLDD tool could not generate a log file after creating a forensic image or calculate the hash value of created image, even though these functions are mentioned in the tool manual. In addition, log file generated by DCFLDD provided more information (e.g., total time to create the image and verify, source device information, and hash values comparison) compared to DC3 DD (presented in Appendix D ([[https://github.com/imdadullahunsw/forensics](https://github.com/imdadullahunsw/forensics)]([https://github.com/imdadullahunsw/forensics](https://github.com/imdadullahunsw/forensics)), accessed on 7 June 2022)). The forensic images created by these tools had the same hash values as the source. In addition, hash values in generated log files were the same as forensic images after being rechecked. Based on experimental data collected for CPU usage, we note that the DCFLDD used more CPU resources (31%) than DC3 DD (5%) or DCFLDD (4.8%). In addition, only with hard drive 'USB-HD-05' was the percentage of CPU resources used by DCFLDD during the experiment higher compared to DC3 DD. Furthermore, DCFLDD used more CPU resources in peak time (77% CPU) compared to DC3 DD (76%) or DCFLDD (60%). The percentage of CPU resources used by DCFLDD did not change with different hard drives in the test. However, DCFLDD and DC3 DD used more CPU resources in peak time (i.e., highest CPU usage) compared to downtime (lowest CPU usage). On average, DCFLDD used more CPU resources (around 48%) compared to DC3 DD (around 41%) or DCFLDD (around 43%). Furthermore, we note that the amount of CPU usage from selected tools did not change too much with the hard drive of different storage capacities. From the memory usage viewpoint, the DCFLDD used much higher memory resources (949 MB) than DC3 DD (119 MB) or DCFLDD (4.57 MB). In peak time (i.e., highest memory usage), the amount of memory resources used by DCFLDD did not change too much (around 0.6 MB), and DCFLDD did not even change the memory usage, while DC3 DD increased the amount of memory resources from 119 MB to 187.23 MB during peak time. On average, the DCFLDD tool used most of the memory resources compared to DC3 DD and DCFLDD. In addition, the amount of memory used by DCFLDD was six times higher than DC3 DD and 41 times higher than DCFLDD. Recall from Figure 3a, DCFLDD was the first tool to finish the process, the second tool was DC3 DD, and the last one was DCFLDD. When overviewing the total amount of CPU usage, there is not a big difference in the use of CPU between DC3 DD and DCFLDD. Even though sometimes the CPU resources used by DC3 DD were even higher than DCFLDD, DCFLDD was still faster than DC3 DD. However, the amount of memory resources usage affected the speed of the imaging process. The amount of memory usage used by DCFLDD was significantly higher compared to DC3 DD or DCFLDD, and DC3 DD also used more memory resources than DCFLDD (i.e., Figure 5a). Although when running each tool in several hard drives that have the same storage capacity, the time it takes for the tool to create forensic images still varies. This may happen because of the differences of USB external hard drives and how the tools were developed to collect the data. In conclusion for this test, the DCFLDD and DC3 DDD met the tool functional requirements. However, the information provided by DCFLDD was more detailed, compared to DC3 DD, and its friendly graphical user interface (GUI) was a significant advantage compared to other tools.