Speaker
Description
CRIU’s incremental checkpointing is being used for forensic container snapshot(Stoyanov et al., DFRWS 2026) chains. Soft-dirty tracking cuts snapshot size by about 10× and makes high-frequency capture practical. Live migration only needs a correct final state. Forensics needs the path that led there. Soft-dirty was built for migration and is now being reused for forensics.
A forensic snapshot chain starts with one full snapshot, then stores only later changes. Hash-chaining makes tampering detectable, as long as the host kernel and CRIU stay trusted.
This talk brings the discusion of the challenges with the existing memory tracking mechanism and improvements for forensic use.
Soft-dirty answers one question: did this page change since the last reset? It cannot say when, how many times, in what order, or by whom. Tracking makes pages read-only and catches the first write to each but a page written once and a page written ten thousand times are indistinguishable. Every intermediate value is gone, along with any ordering or context. Even when two pages change, the kernel walks page tables.
Some ways to improve this tracking for forensic checkpointing at container level, have been inspired from several of live migration, hypervisor specific and hardware trapping techniques. One such direction might be maintaining a kernel level dirty set of pages. PAGEMAP_SCAN already helps here, but CRIU mainly uses it as a faster way to read soft-dirty. The tracking mechanism is unchanged, and the kernel-side still walks the range, there is no maintained dirty set, only a faster way to report the outcome of a walk.
Another direction can be to finally start utilising the first-write page fault data rather than discarding almost everything it exposes. Today’s interfaces force a choice: async uffd-wp is cheap but reports one bit, while sync uffd-wp can report richer data at a userspace round trip per fault. Forensics needs rich-and-cheap: capture at the fault, kernel-side, without that round trip.
A separate, lighter option is to recover changed bytes by diffing a captured page against its parent and storing only the difference.
At last, soft-dirty is not broken. It does what live migration needed, well enough that forensic snapshot chains already use it. The problem is that forensics asks a different question, and the interface has no answer for it. Upstream work so far has made the answer cheaper to retrieve without making it richer.