IT Forensics · Linux

Forensic analysis of OverlayFS – Correctly analysing layered file systems

OverlayFS combines multiple directory layers into a single file system that is transparent to applications. It is frequently used by container runtime environments such as Docker, as well as by live Linux systems.

Enquire without obligation

For forensic analysis, the distinction between the immutable lower layer and the writable upper layer is crucial, as only the upper layer contains the changes made during runtime.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy, a forensic image or a data source captured in a technically equivalent manner that preserves the integrity of the evidence. The original evidence remains unchanged and is stored in a manner that preserves its integrity.

Our services

We identify the OverlayFS layers involved, separate lower- and upper-layer content, and specifically analyse the changes made to the upper layer during runtime.

Typical areas of application

•Investigation of containerised runtime environments
•Analysis of live Linux and rescue systems
•Reconstruction of runtime-specific changes
•Separation of the base image and runtime data
•Incident Response on Linux Systems
•Judicial and non-judicial expert reports

This is how an OverlayFS analysis works

Once the backup has been completed, the layer structure of the OverlayFS mount is first determined. The lower and upper layers are analysed separately, with the focus on the changes made during runtime that are contained within the upper layer. The results are correlated with the respective container or system context.

Why is the OverlayFS analysis relevant from a forensic perspective?

Container and live systems use OverlayFS to leave base images unchanged and to record runtime changes separately. These runtime changes are often of key interest in forensic investigations.

If the layer structure is not taken into account correctly, base image content may be mistakenly interpreted as runtime-specific changes, or vice versa. Careful separation is therefore essential.

Frequently Asked Questions

What is the difference between the lower layer and the upper layer?+
The lower layer is usually immutable and contains the base data, whilst the upper layer incorporates the changes made at runtime.
Is OverlayFS used by Docker?+
Yes, OverlayFS – or storage drivers based on it – are among the most widely used storage drivers for container images and runtimes.
Are changes retained after a container is terminated?+
That depends on the configuration. Without a persistent volume, changes made at the upper layers may be lost when the container is removed.

🔗 Related topics

LanCologne – Linux Forensics Cologne

Do you require a professional forensic investigation into „forensic analysis of OverlayFS"? LanCologne can assist you with the legally admissible preservation of digital evidence and the traceable analysis of relevant Linux artefacts.

Get in touch now