The crime scene presented an anomaly: a high-security safe open with no signs of mechanical violence. No crowbars, no drills. The only clue was the lock cylinder, seemingly intact. For traditional investigators, it was a dead end. For the digital forensics team, it was the start of a 3D profilometry analysis that would reveal wear marks at a nanometric scale, left by an optical decoding tool manufactured with a consumer-grade 3D printer.
Forensic pipeline: from confocal microscope to Blender simulation 🛠️
The process began with scanning the cylinder using a Keyence VK-X confocal microscope. The Keyence VK Analyzer software generated a point cloud with a lateral resolution of 0.1 microns and a vertical resolution of 0.01 nanometers. There, parallel striations 2.3 microns wide were identified, a pattern that did not match the natural wear of brass. These micro-marks were extracted as a high-density mesh and imported into Geomagic Design X. In this software, the topography of the marks was inverted to model the negative of the tool tip that caused them. The result was a 3D solid that was exported to Blender. There, the insertion and rotation kinematics of the attack were simulated, confirming that the scratch pattern matched the profile of an optical decoding key printed in 50-micron layers. The specific roughness of the marks even allowed identifying the type of filament and the orientation of the printer nozzle.
Precision as proof of authorship 🔍
The most revealing aspect was not the tool itself, but the trace of its manufacturer. The micro-marks on the cylinder not only revealed the key's geometry, but also the unique imperfections of the attacker's 3D printing process. Every FDM printer leaves a mechanical signature on parts: variations in extruder flow, micro-vibrations in the axes, and layer patterns. By comparing the 2.3-micron striations with the printing artifacts of the recovered piece, the attack could be linked to a specific printer model. 3D profilometry not only solved the how, but closed the forensic circle by identifying the weapon's origin.
How would you integrate this finding into an existing forensic pipeline?