docker-explorer
A forensic tool for exploring offline Docker filesystems to analyze compromised containers.
What is docker-explorer?
Docker Explorer is a forensic analysis tool designed to help investigators examine offline Docker container filesystems. It provides the same view of a container's filesystem as if it were running, which is crucial when analyzing compromised containers in forensic investigations without requiring a live Docker daemon.
Forensic analysts and incident responders who need to investigate compromised Docker containers from disk images or offline storage, maintaining evidence integrity.
Developers choose Docker Explorer because it enables offline forensic analysis of Docker containers, mounting layered filesystems like AuFS and OverlayFS for tools like log2timeline, unlike live Docker commands that require a running daemon.
Overview
A tool to help forensicate offline docker acquisitions
Use Cases
Best For
- Forensic examination of compromised Docker containers from disk images without a live Docker daemon.
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
