Abstract: Aiming at the shortcomings of forensic technology based on Docker container, we proposed an investigation and forensics model based on Docker host, and gave a targeted data forensics method according to the different states of the Docker host in 
the forensic model. The experimental results show that the forensics  can obtain relevant electronic evidence more specifically by using the model.

Key words: Docker, container, image, digital forensic