├── .dockerignore ├── .gitattributes ├── .gitignore ├── .idea ├── codeStyles │ └── codeStyleConfig.xml ├── encodings.xml ├── inspectionProfiles │ └── Project_Default.xml ├── masterarbeit-code.iml ├── misc.xml ├── modules.xml └── vcs.xml ├── .travis.yml ├── Dockerfile ├── LICENSE ├── Pipfile ├── Pipfile.lock ├── README.md ├── USAGE.md ├── create_zipfile_from_testimage.py ├── dof.spec ├── list-containers-to-csv.awk ├── screenshots └── mounting-images.png ├── src └── dof │ ├── __init__.py │ ├── argparse_actions.py │ ├── commands │ ├── __init__.py │ ├── carve_for_deleted_docker_files.py │ ├── container_filesystem_mounting.py │ ├── docker_host_status.py │ ├── dump_container_config.py │ ├── image_mounting.py │ ├── list_containers.py │ ├── list_images.py │ ├── macrobber_container_layer.py │ ├── macrobber_volumes.py │ ├── show_container_logs.py │ ├── show_image_config.py │ └── show_image_history.py │ ├── decorators.py │ ├── infrastructure │ ├── __init__.py │ ├── container_locator.py │ ├── disk_mounting │ │ ├── __init__.py │ │ └── imagemounter_lib.py │ ├── docker_binaries_locator.py │ ├── image_locator.py │ ├── logging.py │ ├── mac_robber.py │ ├── scalpel_docker.conf │ └── swarm_config_locator.py │ ├── main.py │ └── model │ ├── __init__.py │ ├── container.py │ ├── docker_environment.py │ └── image.py └── tests ├── argparse_actions_test.py ├── assertions.py ├── assertions_test.py ├── commands ├── docker_host_status_test.py ├── list_containters_test.py └── list_images_test.py ├── conftest.py ├── files_for_integration_test.tgz ├── infrastructure ├── container_locator_test.py ├── docker_binaries_locator_test.py ├── image_locator_test.py └── local_log_deserialiser_test.py ├── main_test.py ├── model └── container_test.py ├── stubs.py └── swarm ├── docker-state.json ├── state.json └── swarm_config_locator_test.py /.dockerignore: -------------------------------------------------------------------------------- 1 | testimages 2 | **/__pycache__ 3 | *.pyc 4 | -------------------------------------------------------------------------------- /.gitattributes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.gitattributes -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.gitignore -------------------------------------------------------------------------------- /.idea/codeStyles/codeStyleConfig.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.idea/codeStyles/codeStyleConfig.xml -------------------------------------------------------------------------------- /.idea/encodings.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.idea/encodings.xml -------------------------------------------------------------------------------- /.idea/inspectionProfiles/Project_Default.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.idea/inspectionProfiles/Project_Default.xml -------------------------------------------------------------------------------- /.idea/masterarbeit-code.iml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.idea/masterarbeit-code.iml -------------------------------------------------------------------------------- /.idea/misc.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.idea/misc.xml -------------------------------------------------------------------------------- /.idea/modules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.idea/modules.xml -------------------------------------------------------------------------------- /.idea/vcs.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.idea/vcs.xml -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/.travis.yml -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/Dockerfile -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/LICENSE -------------------------------------------------------------------------------- /Pipfile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/Pipfile -------------------------------------------------------------------------------- /Pipfile.lock: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/Pipfile.lock -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/README.md -------------------------------------------------------------------------------- /USAGE.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/USAGE.md -------------------------------------------------------------------------------- /create_zipfile_from_testimage.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/create_zipfile_from_testimage.py -------------------------------------------------------------------------------- /dof.spec: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/dof.spec -------------------------------------------------------------------------------- /list-containers-to-csv.awk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/list-containers-to-csv.awk -------------------------------------------------------------------------------- /screenshots/mounting-images.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/screenshots/mounting-images.png -------------------------------------------------------------------------------- /src/dof/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /src/dof/argparse_actions.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/argparse_actions.py -------------------------------------------------------------------------------- /src/dof/commands/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /src/dof/commands/carve_for_deleted_docker_files.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/carve_for_deleted_docker_files.py -------------------------------------------------------------------------------- /src/dof/commands/container_filesystem_mounting.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/container_filesystem_mounting.py -------------------------------------------------------------------------------- /src/dof/commands/docker_host_status.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/docker_host_status.py -------------------------------------------------------------------------------- /src/dof/commands/dump_container_config.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/dump_container_config.py -------------------------------------------------------------------------------- /src/dof/commands/image_mounting.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/image_mounting.py -------------------------------------------------------------------------------- /src/dof/commands/list_containers.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/list_containers.py -------------------------------------------------------------------------------- /src/dof/commands/list_images.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/list_images.py -------------------------------------------------------------------------------- /src/dof/commands/macrobber_container_layer.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/macrobber_container_layer.py -------------------------------------------------------------------------------- /src/dof/commands/macrobber_volumes.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/macrobber_volumes.py -------------------------------------------------------------------------------- /src/dof/commands/show_container_logs.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/show_container_logs.py -------------------------------------------------------------------------------- /src/dof/commands/show_image_config.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/show_image_config.py -------------------------------------------------------------------------------- /src/dof/commands/show_image_history.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/commands/show_image_history.py -------------------------------------------------------------------------------- /src/dof/decorators.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/decorators.py -------------------------------------------------------------------------------- /src/dof/infrastructure/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /src/dof/infrastructure/container_locator.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/container_locator.py -------------------------------------------------------------------------------- /src/dof/infrastructure/disk_mounting/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /src/dof/infrastructure/disk_mounting/imagemounter_lib.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/disk_mounting/imagemounter_lib.py -------------------------------------------------------------------------------- /src/dof/infrastructure/docker_binaries_locator.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/docker_binaries_locator.py -------------------------------------------------------------------------------- /src/dof/infrastructure/image_locator.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/image_locator.py -------------------------------------------------------------------------------- /src/dof/infrastructure/logging.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/logging.py -------------------------------------------------------------------------------- /src/dof/infrastructure/mac_robber.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/mac_robber.py -------------------------------------------------------------------------------- /src/dof/infrastructure/scalpel_docker.conf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/scalpel_docker.conf -------------------------------------------------------------------------------- /src/dof/infrastructure/swarm_config_locator.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/infrastructure/swarm_config_locator.py -------------------------------------------------------------------------------- /src/dof/main.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/main.py -------------------------------------------------------------------------------- /src/dof/model/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /src/dof/model/container.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/model/container.py -------------------------------------------------------------------------------- /src/dof/model/docker_environment.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/model/docker_environment.py -------------------------------------------------------------------------------- /src/dof/model/image.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/src/dof/model/image.py -------------------------------------------------------------------------------- /tests/argparse_actions_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/argparse_actions_test.py -------------------------------------------------------------------------------- /tests/assertions.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/assertions.py -------------------------------------------------------------------------------- /tests/assertions_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/assertions_test.py -------------------------------------------------------------------------------- /tests/commands/docker_host_status_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/commands/docker_host_status_test.py -------------------------------------------------------------------------------- /tests/commands/list_containters_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/commands/list_containters_test.py -------------------------------------------------------------------------------- /tests/commands/list_images_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/commands/list_images_test.py -------------------------------------------------------------------------------- /tests/conftest.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/conftest.py -------------------------------------------------------------------------------- /tests/files_for_integration_test.tgz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/files_for_integration_test.tgz -------------------------------------------------------------------------------- /tests/infrastructure/container_locator_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/infrastructure/container_locator_test.py -------------------------------------------------------------------------------- /tests/infrastructure/docker_binaries_locator_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/infrastructure/docker_binaries_locator_test.py -------------------------------------------------------------------------------- /tests/infrastructure/image_locator_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/infrastructure/image_locator_test.py -------------------------------------------------------------------------------- /tests/infrastructure/local_log_deserialiser_test.py: -------------------------------------------------------------------------------- 1 | 2 | 3 | def test_it_deserialises_into_lines(): 4 | pass 5 | -------------------------------------------------------------------------------- /tests/main_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/main_test.py -------------------------------------------------------------------------------- /tests/model/container_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/model/container_test.py -------------------------------------------------------------------------------- /tests/stubs.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/stubs.py -------------------------------------------------------------------------------- /tests/swarm/docker-state.json: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/swarm/docker-state.json -------------------------------------------------------------------------------- /tests/swarm/state.json: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/swarm/state.json -------------------------------------------------------------------------------- /tests/swarm/swarm_config_locator_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/docker-forensics-toolkit/toolkit/HEAD/tests/swarm/swarm_config_locator_test.py --------------------------------------------------------------------------------