Evaluation of File Carving Tools for Forensic Investigation in Docker Containers

Container Technology has attracted a lot of attention and is increasingly utilized to deploy the industrial applications. Containers are executable units of software which encapsulate the code along with the libraries and other dependencies in order to facilitate the code to run anywhere. They take advantage of operating system virtualization and can run anything from a small microservice or software process to a larger application. Containers are very lightweight as compared to Virtual Machines. They offer high portability with very less overhead. This emerging field of container technology has attracted a lot of attention from the community of researchers. In this paper, we have performed digital forensics on the Docker containers using file carving techniques in order to test whether the lost data from the deleted containers can be retrieved or not. For this purpose, we have used three popular file carving tools and compared their performance. The results of the experiments show that the file carving is an effective way to recover the lost data from the deleted containers.