基于Docker容器的电子数据取证方法

Electronic Data Forensics Method Based on Docker Container

针对目前基于Docker容器的取证技术缺陷,提出一种基于Docker主机的调查取证模型,并根据该取证模型中Docker主机所处不同状态给出有针对性的数据取证方法.实验结果表明,利用该模型取证能更有针对性地获取相关电子证据.

Aiming at the shortcomings of forensic technology based on Docker container,we proposed an investigation and forensics model based on Docker host,and gave a targeted data forensics method according to the different states of the Docker host in the forensic model.The experimental results show that the forensics can obtain relevant electronic evidence more specifically by using the model.