{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,2]],"date-time":"2026-09-02T05:08:01Z","timestamp":1788325681638,"version":"build-2803163510"},"reference-count":32,"publisher":"Association for Computing Machinery (ACM)","issue":"4","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Digital Threats"],"published-print":{"date-parts":[[2025,12,31]]},"abstract":"<jats:p>User-space virtualization in form of containers is an increasingly popular deployment method for software applications. When containers are used in the cloud, an orchestration layer such as Kubernetes is utilized for automated and efficient management. All large cloud service providers offer container solutions in different cloud models. They differ in the level of administrative responsibility that remains with the user. Since containerized applications are affected by these design choices, incident responders face the challenge of quickly accessing relevant artifacts in case a security incident occurs. We investigate, for three different practical cloud deployment models from AWS (EKS, EKS Fargate, and ECS) and two increasingly severe attack scenarios, how much relevant information is accessible in each situation. We show that critically relevant forensic evidence is not available, especially at lower access levels. Our results reveal the limits to the forensic analysis of container applications in the cloud and call for cloud service providers to provide additional information in more lightweight deployment models for incident response.<\/jats:p>","DOI":"10.1145\/3765629","type":"journal-article","created":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T13:17:50Z","timestamp":1756819070000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Limits to the Forensic Analysis of Container Applications in Cloud Environments"],"prefix":"10.1145","volume":"6","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-6585-2234","authenticated-orcid":false,"given":"Kerstin","family":"Schmid","sequence":"first","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Erlangen, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-7880-6618","authenticated-orcid":false,"given":"Konstantin","family":"Bayreuther","sequence":"additional","affiliation":[{"name":"DHBW Mannheim, Mannheim, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8279-8401","authenticated-orcid":false,"given":"Felix","family":"Freiling","sequence":"additional","affiliation":[{"name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU), Erlangen, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,12,13]]},"reference":[{"key":"e_1_3_3_2_1","doi-asserted-by":"publisher","DOI":"10.1186\/s13677-019-0133-z"},{"key":"e_1_3_3_3_1","unstructured":"Amazon. 2024. Turning on ECS Exec for Your Tasks and Services. Retrieved April 9 2024 from https:\/\/docs.aws.amazon.com\/AmazonECS\/latest\/developerguide\/ecs-exec.html"},{"key":"e_1_3_3_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCC.2014.51"},{"key":"e_1_3_3_5_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-10706-1_17"},{"key":"e_1_3_3_6_1","first-page":"119","volume-title":"Zeitschrift F\u00fcr Datenschutzrecht","author":"Brodowski Dominik","year":"2014","unstructured":"Dominik Brodowski and Florian Eisenmenger. 2014. Der Zugriff auf Cloud-Speicher und Internetdienste durch Ermittlungsbeh\u00f6rden. Zur sachlichen und zeitlichen Reichweite der \u201ckleinen Online-Durchsuchung\u201d nach \u00a7 110 Abs. 3 StPO. Zeitschrift F\u00fcr Datenschutzrecht (2014), 119\u2013126."},{"key":"e_1_3_3_7_1","unstructured":"Chris Doman. 2024. Botnet Deploys Cloud and Container Attack Techniques. Cado Security. Retrieved May 20 2024 from https:\/\/www.cadosecurity.com\/blog\/botnet-deploys-cloud-and-container-attack-techniques?utm_source=tldrsec.com&utm_medium=referral&utm_campaign=keep-hackers-out-of-your-kubernetes-cluster-with-these-5-simple-tricks"},{"key":"e_1_3_3_8_1","unstructured":"Jim Clausing. 2016. Forensicating Docker Part 1. Retrieved March 25 2025 from https:\/\/isc.sans.edu\/diary\/20835"},{"key":"e_1_3_3_9_1","unstructured":"Datadog. 2023. Container Running as Privileged. Retrieved May 20 2024 from https:\/\/securitylabs.datadoghq.com\/cloud-security-atlas\/vulnerabilities\/use-of-privileged-containers\/"},{"key":"e_1_3_3_10_1","unstructured":"Datadog. 2024. An Analysis of a TeamTNT Doppelg\u00e4nger. Retrieved May 20 2024 from https:\/\/securitylabs.datadoghq.com\/articles\/analysis-of-teamtnt-doppelganger\/"},{"key":"e_1_3_3_11_1","unstructured":"Andreas Dewald Matthias Luft and Julian Suleder. 2018. Incident Analysis and Forensics in Docker Environments. ERNW White Paper 64. ERNW. Retrieved from https:\/\/ernw.de\/en\/whitepapers\/issue-64.html"},{"key":"e_1_3_3_12_1","unstructured":"Docker. 2024. Use the OverlayFS Storage Driver. Retrieved April 5 2024 from https:\/\/docs.docker.com\/storage\/storagedriver\/overlayfs-driver\/"},{"key":"e_1_3_3_13_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.DIIN.2012.05.001"},{"key":"e_1_3_3_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2015.81"},{"key":"e_1_3_3_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICC45041.2023.10278764"},{"key":"e_1_3_3_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3664476.3670895"},{"key":"e_1_3_3_17_1","unstructured":"Clint Gibler. 2024. Keep Hackers Out of Your Kubernetes Cluster with These 5 Simple Tricks! Retrieved May 17 2024 from https:\/\/tldrsec.com\/p\/kubernetes-security-threat-informed-defense"},{"key":"e_1_3_3_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866835.1866850"},{"key":"e_1_3_3_19_1","first-page":"119","volume-title":"9th USENIX Symposium on Operating Systems Design and Implementation (OSDI \u201910)","author":"Haeberlen Andreas","year":"2010","unstructured":"Andreas Haeberlen, Paarijaat Aditya, Rodrigo Rodrigues, and Peter Druschel. 2010. Accountable virtual machines. In 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI \u201910). Remzi H. Arpaci-Dusseau and Brad Chen (Eds.), USENIX Association, 119\u2013134. Retrieved from http:\/\/www.usenix.org\/events\/osdi10\/tech\/full_papers\/Haeberlen.pdf"},{"key":"e_1_3_3_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00268"},{"key":"e_1_3_3_21_1","doi-asserted-by":"publisher","unstructured":"T. Grance and P. Mell. 2011. The NIST Definition of Cloud Computing. NIST SP 800-145. National Institute of Standards and Technology. DOI: 10.6028\/NIST.SP.800-145","DOI":"10.6028\/NIST.SP.800-145"},{"key":"e_1_3_3_22_1","doi-asserted-by":"publisher","DOI":"10.1186\/S13677-022-00303-8"},{"key":"e_1_3_3_23_1","unstructured":"MITRE. 2024. Containers Matrix. Retrieved April 16 2024 from https:\/\/attack.mitre.org\/matrices\/enterprise\/containers\/"},{"key":"e_1_3_3_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev51306.2021.00022S"},{"key":"e_1_3_3_25_1","volume-title":"Container Security","author":"Rice Liz","year":"2020","unstructured":"Liz Rice. 2020. Container Security. O\u2019Reilly Media, Inc."},{"key":"e_1_3_3_26_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.DIIN.2007.04.002"},{"key":"e_1_3_3_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-24212-0_3"},{"key":"e_1_3_3_28_1","first-page":"1","volume-title":"53rd Hawaii International Conference on System Sciences (HICSS \u201920)","author":"Shropshire Jordan","year":"2020","unstructured":"Jordan Shropshire and Ryan Benton. 2020. Container and VM visualization for rapid forensic analysis. In 53rd Hawaii International Conference on System Sciences (HICSS \u201920). ScholarSpace, 1\u201310. Retrieved from https:\/\/hdl.handle.net\/10125\/64525"},{"key":"e_1_3_3_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607205"},{"key":"e_1_3_3_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3339252.3340505"},{"key":"e_1_3_3_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.DIIN.2017.06.008"},{"key":"e_1_3_3_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485314.3485326"},{"key":"e_1_3_3_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3199478.3199506"}],"container-title":["Digital Threats: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3765629","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,13]],"date-time":"2025-12-13T11:59:04Z","timestamp":1765627144000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3765629"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,13]]},"references-count":32,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,12,31]]}},"alternative-id":["10.1145\/3765629"],"URL":"https:\/\/doi.org\/10.1145\/3765629","relation":{},"ISSN":["2692-1626","2576-5337"],"issn-type":[{"value":"2692-1626","type":"print"},{"value":"2576-5337","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,12,13]]},"assertion":[{"value":"2025-05-11","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-08-04","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-12-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}