BSidesSF 2018 - Pensieve: Finding Malicious Artifacts in Container Environments (Yathi Naik)

**Overview** Yathi Naik from StackRox presents Pensieve, a framework for detecting malicious artifacts in container environments. Drawing an analogy to Dumbledore's Pensieve from Harry Potter, Naik argues that containers require specialized forensic tools to identify patterns and anomalies, since traditional incident response and digital forensics techniques designed for virtual machines do not translate efficiently to containerized workloads.

**Key Topics** The talk covers Docker fundamentals, including how containers use Linux namespaces and control groups (cgroups) for process isolation and resource management. Naik explains that containers are isolated processes sharing a kernel, each with unique process IDs (PIDs) within their namespace—complicating log analysis and forensic correlation. Docker images employ a layered filesystem architecture with read-only image layers and a thin read-write container layer, using copy-on-write semantics via drivers like OverlayFS or AUFS.

**Forensic Challenges & File Recovery** The speaker identifies major obstacles in container forensics: traditional tools like memory extraction cannot easily isolate individual container memory; deleted files may reside in read-write or read-only layers requiring different recovery strategies; and container metadata stored in /var/lib/docker is essential for linking evidence to specific containers. Naik describes two file recovery techniques: file extraction (pattern scanning for file headers like PDF, ELF, JPEG) and filesystem analysis (leveraging metadata like inode tables and directory entries). For AUFS-based systems, recovered files can be linked to containers by matching AUFS layer identifiers.

**CRIU and Live Demonstration** The talk highlights CRIU (Checkpoint and Restore in User Space) and its companion tool CRIT (CRIU Image Tool) as container-aware alternatives to traditional forensic tools like Volatility. CRIU freezes running processes into checkpoint image files, allowing later analysis of process lists, network connections, and open file descriptors without capturing entire host memory. A live demonstration shows a container running vulnerable Apache Struts being attacked via Metasploit, with CRIU capturing evidence before and after exploitation—including spawned reverse shell processes and established network connections on ports 8080, 8089, and 4444.

**Takeaways** Container security forensics requires purpose-built tools that account for namespaces, layered filesystems, and container metadata. Traditional tools must be adapted with Docker context to be effective. CRIU and similar technologies offer promising avenues for efficient, targeted memory analysis in containerized environments, reducing the need for full host memory snapshots—a significant advantage in managed container services like AWS Fargate where host-level tools are unavailable.