CONTAIN4n6: a systematic evaluation of container artifacts

Abstract A container provides an environment where applications are packaged and run with the supporting libraries dependencies. Due to scalability efficient software deployment, popularity of technology has increased its services also available on cloud platforms. The is prone a variety threats vulnerabilities that lead security breaches attacks. Investigation required analyze attack digital forensics processes have been implemented in environment. In this paper, we present systematic evaluation artifacts. An interface named CONTAIN4n6 developed collect data from extracts using introspection libraries, file systems, capable trace system call running container. functionality calls traces open source containerization software, i.e, Moby project. Container’s artifacts associated environmental information, log files, directories, link repositories, etc. Data collected multiple sources stored database created hash values maintain integrity data. case study privilege escalation attacks demonstrated which used validate collection tool, called, CONTAIN4n6. Research challenges forensic investigations containerized presented.