DCFF: a container forensics framework based on Docker

As a lightweight and flexible virtualization technology, container virtualization has been adopted by more and more platform as a service (PaaS) system. With the popularity of container virtualization and PaaS, cloud forensics need to find a way of extracting integrate and reliable data from containers. In this paper, we propose a container forensics framework called DCFF which is designed to acquire data simultaneously from containers running on different hosts and transform forensics data into compatible format centrally.