DFIR ORC
#Incident Management#Digital Forensics
Analyse a forensic target to find and report files found and not found in hashlookup CIRCL public service.
Build Branch Status Overview
main release/10.1
- release/10.2
System Requirements for Visual Studio Setup
Visual Studio Versions: 2017 to 2022
- Language: English only (this is a limitation of vcpkg)
To set up the environment, use this installer configuration or alternatively employ vstools. Additionally, ensure you check the option for 'Desktop development with C++'. You will need Kitware's CMake version 3.25 or higher, or the integrated version of CMake in Visual Studio. For a quick setup of the build environment, you can use Microsoft's developer virtual machines. Import the .vsconfig file from the Visual Studio Installer.
Commands:
- To ensure maximum compatibility before deployment, both 32-bit and 64-bit versions should be built.
- For more information regarding deployment and configuration, visit https://dfir-orc.github.io.
In a command prompt like Developer Command Prompt for VS 2019 (it is preferable to avoid using cmd.exe), execute the following commands:
- git clone --recursive https://github.com/dfir-orc/dfir-orc.git
- cd dfir-orc
- mkdir build-x86 build-x64
- cd build-x86
- cmake -G 'Visual Studio 17 2022' -A Win32 -T v141_xp ..
- cmake --build . --config MinSizeRel -- -maxcpucount
- cd ../build-x64
- cmake -G 'Visual Studio 17 2022' -A x64 -T v141_xp ..
- cmake --build . --config MinSizeRel -- -maxcpucount
The -T v141_xp Option Explained
The -T v141_xp option enables compatibility with Windows XP SP2 and later versions. If this compatibility is not required, the option can be safely removed.