DFIR ORC

Analyse a forensic target to find and report files found and not found in hashlookup CIRCL public service.

main release/10.1 - release/10.2

Visual Studio Versions: 2017 to 2022 - Language: English only (this is a limitation of vcpkg) To set up the environment, use this installer configuration or alternatively employ vstools. Additionally, ensure you check the option for 'Desktop development with C++'. You will need Kitware's CMake version 3.25 or higher, or the integrated version of CMake in Visual Studio. For a quick setup of the build environment, you can use Microsoft's developer virtual machines. Import the .vsconfig file from the Visual Studio Installer. Commands: - To ensure maximum compatibility before deployment, both 32-bit and 64-bit versions should be built. - For more information regarding deployment and configuration, visit https://dfir-orc.github.io. In a command prompt like Developer Command Prompt for VS 2019 (it is preferable to avoid using cmd.exe), execute the following commands: - git clone --recursive https://github.com/dfir-orc/dfir-orc.git - cd dfir-orc - mkdir build-x86 build-x64 - cd build-x86 - cmake -G 'Visual Studio 17 2022' -A Win32 -T v141_xp .. - cmake --build . --config MinSizeRel -- -maxcpucount - cd ../build-x64 - cmake -G 'Visual Studio 17 2022' -A x64 -T v141_xp .. - cmake --build . --config MinSizeRel -- -maxcpucount

The -T v141_xp option enables compatibility with Windows XP SP2 and later versions. If this compatibility is not required, the option can be safely removed.