<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-container-forensics
description: >-
  Perform digital forensics on compromised containers including evidence
  collection from running and stopped containers, filesystem analysis, network
  artifact recovery, memory analysis, and timeline reconstruction for
  incident investigation in Docker and Kubernetes environments.
domain: cybersecurity
subdomain: container-security
tags:
  - container-forensics
  - incident-response
  - evidence-collection
  - filesystem-analysis
  - memory-forensics
  - timeline-reconstruction
  - docker
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Performing Container Forensics

## Overview

Container forensics presents unique challenges due to ephemeral workloads,
layered filesystems, and shared kernel resources. This skill covers evidence
preservation from running and stopped containers, filesystem diff analysis,
network artifact recovery, process and memory inspection, Kubernetes-specific
evidence sources, and timeline reconstruction for container-based incidents.

Mode: `[MODE: INCIDENT]` — Forensic investigation and evidence preservation.

## Prerequisites

| Requirement | Details |
|---|---|
| Docker CLI and/or `crictl` for container runtime access | Required |
| `kubectl` for Kubernetes cluster access | Required |
| Forensic tools | `volatility3` (memory), `sleuthkit` (filesystem) |
| Container export capability (docker export/save) | Required |
| Secure evidence storage with chain-of-custody tracking | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/performing-container-forensics-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/performing-container-forensics-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/performing-container-forensics-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Container Forensics Detection
id: 74dc5c74-825f-4843-ba63-2e170138ea0d
status: experimental
description: Detects suspicious activity related to performing container forensics techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Container Forensics Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Docker Forensics](https://docs.docker.com/engine/reference/commandline/export/)
- [NIST SP 800-86 — Guide to Integrating Forensic Techniques](https://csrc.nist.gov/publications/detail/sp/800-86/final)
- [Kubernetes Forensics](https://kubernetes.io/docs/tasks/debug/)
