# Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand
## 7 Conclusions  
We presented a research gap for studying forensic imaging tools for forensic investigations and the necessity to carry out analyses on second-hand storage devices in the local market in New Zealand. We described the experimental quantitative research methodology, research model, and the processes to evaluate the forensic tools (mainly the DC3 DD, DCFLDD, and Guymager) for NIST functional and optional requirements and to collect the remnant data from purchased hard drives. In our findings, we noted that DC3 DD and Guymager met most of the tool functionalities in different test cases. However, there is only one function that these tools failed ('DI-RO-07'), apart from that, all other functionalities worked as expected. The information saved in the log files generated by Guymager include more data compared to DCFLDD and DC3 DD. In addition, DC3 DD and DCFLDD did not have a user interface, and all requests must be inputted via the command line except for Guymager, which has a user-friendly GUI. Overall, Guymager was the best tool in terms of tool functionalities and tool performance (less time consumption compared to other tools). After recovering \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c c} \hline \hline \multicolumn{12}{c}{**NIST Tools**} & \multicolumn{12}{c}{**Articles**} \\ \hline
**Req. ID** & [20] & [53] & [52] & [54] & [19] & [21] & [55] & [56] & [57] & [13] & [12] & [14] & [44] & **Ours** \\ \hline DI-RM-01 & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline DI-RM-02 & ✓ & ✓ & ✓ & ✗ & ✗ & ✗ & ✓ & ✗ & ✗ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline DI-RM-03 & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline DI-RM-04 & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline DI-RM-05 & ✓ & ✗ & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ & ✗ & ✗ & ✓ \\ \hline DI-RM-06 & ✓ & ✓ & ✗ & ✓ & ✓ & ✓ & ✓ & ✓ & ✗ & ✗ & ✓ & ✗ & ✓ & ✓ \\ \hline DI-RM-07 & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ & ✗ & ✗ & ✓ & ✗ & ✗ & ✓ \\ \hline DI-RM-08 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline DI-RO-01 & ✗ & ✓ & ✗ & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-02 & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline DI-RO-03 & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline DI-RO-04 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline DI-RO-05 & ✗ & ✗ & ✗ & ✗ & ✓ & ✓ & ✗ & ✓ & ✓ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-06 & ✗ & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-07 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-08 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-09 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-10 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-11 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-12 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-13 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-14 & ✗ & ✗ & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-15 & ✗ & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-16 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline DI-RO-17 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & � & ✗ \\ \hline DI-RO-18 & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & � & ✗ & ✗ & � & � \\ \hline \hline \end{tabular}
\end{table} 
Table 8: NIST functional and optional requirements tested in previous works. data from purchased USB external hard drives, we found the vast majority of remnant data and information (e.g., bank transactions, contracts, CVs, photos, and videos), which could help to determine the identity of the previous owner. We noted that roughly 90% of the hard drives contained personal/organisational sensitive data, specifically 6 out of 17 hard drives contained organisation information, and 10 out of 17 hard drives contained personal information. Data collected from hard drives indicate that users in New Zealand are not fully aware of data security. Conceptualisation: Z.S., A.K. and A.L. ; Methodology: H.P.T.