This project helps a forensics analyst explore offline Docker filesystems. When analyzing a system where a Docker container has been compromised, it can be useful to have the same view of the filesystem as the container's. Docker uses layered backend filesystems like AuFS or OverlayFS, with each layer stored on the host's filesystem as multiple folders. Some JSON files are used by Docker to know what is what. Installation methods include PPA, PyPI, and cloning the repository. Usage involves finding the interesting container ID, mounting the container's filesystem in /mnt/container, and using tools like log2timeline.py or ls.
FEATURES
This tool is not verified yet and doesn't have listed features.
Did you submit the verified tool? Sign in to add features.
Are you the author? Claim the tool by clicking the icon above. After claiming, you can add features.
ALTERNATIVES
Automated Mac Forensic Triage Collector
A tool for extracting files from packet capture files with ease of use and extensibility for Python developers.
A library and tools for accessing and analyzing Linux Logical Volume Manager (LVM) volume system format.
A tool that uses Plaso to parse forensic artifacts and disk images, creating custom reports for easier analysis.
Recover event log entries from an image by heuristically looking for record structures.
Visually inspect regex matches in binary data/text with YARA and regular expressions, displaying matched bytes and surrounding context.