mozilla / mig

Distributed & real time digital forensics at the speed of the cloud

Home Page:http://mig.mozilla.org/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Better support for aufs file systems in file module, container identification

ameihm0912 opened this issue · comments

It might be nice if the file module better handled aufs containers (e.g., docker container file systems) for running containers on the system.

This may be done by adding a bit of code to the file module so it understands the general format of the aufs structure; or only reviews aufs mounted file systems from the perspective of the host and skips the lower container layers in the file system checks.

The objective would be eliminating "hits" for previous versions of a file, or otherwise noting those hits as belonging to an aufs file system which has since been obsoleted by an upper layer.