2

For the purpose of a forensic mission, we must get a docker image without using the famous export from a docker command.

Does copy and paste of the folder /var/lib/docker/containers in another server allow us to retrieve information without any corrupted data?

Thanks.

2 Answers 2

0

You can docker commit the container, then push it to a repository for further use/replication/forensic

2
  • Yeah, the goal here is to not use any docker * commands like.
    – Duke Nukem
    Mar 29, 2017 at 7:46
  • That is not what the question says. Please update it.
    – Bruno9779
    Mar 29, 2017 at 12:36
0

I think there is some terminology confusion here. A docker image is not the same as a forensic image. See the following two definitions.

A Docker image is an immutable (unchangeable) file that contains the source code, libraries, dependencies, tools, and other files needed for an application to run.

A forensic image is a special type of copy of the original evidence, it contains all of the data found in the original, but that data is encapsulated in a forensic file format which makes it tamper-proof.

So, I can imagine that the data from the mounted docker volumes is more relevant for a forensic investigation than the data from the docker image. Also, typically the lifetime of a container is less than one day so one should wonder in what specific use cases such forensic images are useful. As a forensic investigator I would probably make a physical (or logical) forensic image of the whole disk of the host machine that runs those docker containers and than narrow down your investigation in proper forensic software. That probably holds up better legally as well.

I'm not sure why exactly you want to avoid using docker commands, but if used I would log rather precisely on what exact times certain actions were performed. Another way would be to use the docker info command to find the volume locations and make a logical forensic image of that. Also you might be interested in the docker container export command but again that's about the docker image, not the docker volumes. I can imagine in certain cases making a container checkpoint (snapshot) with docker or pause/unpause a running container might be helpful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.