CHFI Application, Email and Cloud Forensics Practice Question
A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use 'docker commit' to create an image of the container
Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restart the container and use 'docker exec' to collect evidence
Why it's wrong here
Restarting the container is fatal to forensic integrity: it destroys the original process environment, clears runtime state in /proc and /sys, invalidates ephemeral file handles, and may trigger Docker's cleanup logic for stopped containers. Running 'docker exec' after restart yields evidence from a new execution context, not the original container. The container's PID 1 and any temporary files created during the incident are also altered, making the evidence inadmissible.
- ✗
Use 'docker inspect' to view container metadata only
Why it's wrong here
'docker inspect' returns structured metadata about the container, such as its startup configuration, environment variables, mount points, network settings, image hash, and timestamps, but it never reads the container's writable layer or file contents. This metadata is useful for establishing context, but cannot recover data stored in the container. As an acquisition technique it is incomplete because it produces no filesystem snapshot or byte-level copy for forensic analysis.
- ✗
Use 'docker save' to export the container as a tar file
Why it's wrong here
'docker save' is designed to archive images, not containers. Passing a container ID to 'docker save' either produces an error or, in some workflows, captures only the base image rather than the container's unique writable layer. All application-generated changes, deleted files, and container-specific state would be missing from the evidence. The correct workflow is to first 'docker commit' the container into an image and then use 'docker save' to archive that image.
- ✓
Use 'docker commit' to create an image of the container
Why this is correct
'docker commit' captures the container's current writable layer into a new image, preserving the filesystem state at a defined moment without modifying the original container's content. By default, Docker pauses the container during the commit, giving a point-in-time consistent snapshot that can be exported with 'docker save' and analyzed in a sandbox. This method is the best option listed because it preserves the container's filesystem evidence in a non-destructive way, although it does not capture live memory or active network connections.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.