<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Container Forensics — API Reference

## Docker Evidence Collection

```bash
docker export CONTAINER > fs.tar
docker commit CONTAINER evidence/compromised:TAG
docker inspect CONTAINER
docker logs --timestamps CONTAINER
docker cp CONTAINER:/path/to/file ./evidence/
docker top CONTAINER
```

## crictl Commands (containerd/CRI-O)

```bash
crictl inspect CONTAINER_ID
crictl logs CONTAINER_ID
crictl ps
crictl stats CONTAINER_ID
```

## kubectl Forensic Commands

```bash
kubectl get pod POD -n NS -o yaml
kubectl describe pod POD -n NS
kubectl get events -n NS --field-selector involvedObject.name=POD --sort-by='.lastTimestamp'
kubectl logs POD -n NS --all-containers
kubectl logs POD -n NS --all-containers --previous
kubectl debug POD -n NS --image=busybox -it
kubectl debug node/NODE --image=busybox -it
```

## Evidence Hashing

```bash
sha256sum evidence/*
sha256sum -c checksums.txt
```

## Filesystem Analysis

```bash
find /rootfs -type f -mmin -60 -ls        # Recent files
find /rootfs -perm /6000 -type f -ls       # SUID/SGID
find /rootfs -perm -o+w -type f -ls        # World-writable
find /rootfs -name ".*" -type f -ls        # Hidden files
find /rootfs/tmp -type f -executable -ls   # Executables in /tmp
```
