  The continued adoption of Additive Manufacturing technologies is raising
concerns in the security, forensics, and intelligence gathering communities.
These concerns range from identifying and mitigating compromised devices, to
theft of intellectual property, to sabotage, to the production of prohibited
objects. Previous research has provided insight into the retrieval of
configuration information maintained on the devices, but this work shows that
the devices can additionally maintain information about the print process.
Comparisons between before and after images taken from an AM device reveal
details about the device's activities, including printed designs, menu
interactions, and the print history. Patterns in the storage of that
information also may be useful for reducing the amount of data that needs to be
examined during an investigation. These results provide a foundation for future
investigations regarding the tools and processes suitable for examining these
devices.
