Digital forensic artefacts in Linux-based Creality 3D printers operating on Klipper firmware: Real-world case studies

Abstract

The increasing use of 3D printing for illicit manufacturing, particularly of firearm components, presents growing challenges for forensic investigations. This study examines digital forensic (DF) artefacts recovered from two seized Creality 3D printers operating on Klipper firmware. A structured workflow involving hardware identification, chip-off acquisition, and analysis enabled the recovery of G-code files, configuration data, and log artefacts associated with print activity. While many artefacts originate from the underlying Linux-based system, others—such as Klipper logs, print history records, thumbnail images, and G-code storage—are directly relevant for reconstructing print activities. Artefacts were successfully correlated with seized objects where corresponding G-code files were present, using a combination of digital artefact matching and visual comparison. The absence of certain files primarily affected the completeness of the reconstruction rather than its validity.