Forensics Studies based on Docker Containers
Tang Yongqing, Xingbo Wang, Junyan Chen · 2021
For now, there is little research on forensic methods in docker environments at home and abroad, and there are no forensic tools for such environments on the market. In order to improve the efficiency of forensic work in such environments, this article explores the differences and implementation methods of forensic work in Docker environments. Based on the characteristics and principles of docker file management system Overlay2, this essay gives feasible solutions for the extraction and statistics of file hash values, recovery of deleted files, record of container history process, keyword analysis search and index, etc. And based on this research work, an electronic forensics system for docker containers is designed.