DFIR ORC

No entries match these filters. Clear filters

1. advisory CVE-2026-11958 Jun 18, 2026 · issue 128
   • CVE-2026-11958: Local privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. via DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. side-loading when executed as SYSTEM or from a user-writable directory (affects <10.2.8)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
2. v10.3.0 Apr 17, 2026 · release notes

   DFIR ORC v10.3.0 introduces OrcCapsule loader, WolfLauncher /MultipleInstance, and several new CLI options

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.3.0 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.3.0

   └──▷ USE IT
   Run WolfLauncher allowing multiple instances to process concurrent evidence collections
   shell copy

   WolfLauncher /MultipleInstance

   Use ToolEmbed with the new /force flag to overwrite an existing output binary without prompt
   shell copy

   ToolEmbed /embed <target> /force

   Customize sample naming scheme in GetThis using the new SampleNameFormat option
   shell copy

   GetThis /SampleNameFormat <custom_format>

   • Adds OrcCapsule binary loader that selects the most capable embedded DFIR-ORC binary for the host environment (x64, x86, x64-xp, x86-xp, arm64)
   • Adds /MultipleInstance execution option to WolfLauncher
   • Allows default multiple running instances of OrcOffline in WolfLauncher
   • Adds SampleNameFormat option to GetThis for custom naming schemes
   • Adds timezoneinfo to Outcome output

   +2 more show less

   • Makes ToolEmbed /embed option more flexible and adds /force overwrite capability
   • Updates WolfLauncher CLI with CommandTimeout and ArchiveTimeout options

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !DFIR-ORC output files and directories ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. no longer inherit permissions; they are now restricted to the current user and administrators
   • !ToolEmbed options input, run32, and run64 are deprecated
3. v10.2.7 Mar 26, 2025 · release notes

   DFIR ORC v10.2.7 adds physicalmemory and diskfree archive conditions for WolfLauncher.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.2.7 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.2.7

   └──▷ USE IT
   Collect physical memory artifacts in a forensic image
   shell copy

   WolfLauncher.exe ... /archive:"physicalmemory: true"

   Only run the collection if sufficient disk space is available
   shell copy

   WolfLauncher.exe ... /archive:"diskfree: 10GB"

   • Adds physicalmemory condition to WolfLauncher archive configuration
   • Adds diskfree configurable requirement to WolfLauncher archive configuration
   • Enables ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support for extension libraries

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !WolfLauncher outcome command field type is renamed to source
4. v10.2.5 Jun 12, 2024 · release notes

   Adds HypervisorType detection, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. share cleanup option, and RunId pattern to Outline for DFIR ORC v10.2.5

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.2.5 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.2.5

   └──▷ USE IT
   Identify specific execution runs by their ID in the outline output files.
   text copy

   ApplyPattern({RunId})

   • Adds HypervisorType support to detect hypervisor environments on target systems.
   • Adds {RunId} pattern to OutputSpec.ApplyPattern for identifying execution runs.

   2 details in Everything

5. v10.2.4 Feb 8, 2024 · release notes

   ORC v10.2.4 adds install/shutdown time extraction from registry, Yara 4.4.0 support, and several library enhancements.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.2.4 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.2.4

   • Adds computer_name field to OrcCommand WolfLauncher Outline for host identification
   • Adds SystemIdentity.install_date, install_time, and shutdown_time fields to capture system timeline events
   • Adds GetInstallDateFromRegistry, GetInstallTimeFromRegistry, and GetShutdownTimeFromRegistry functions in OrcLib::SystemDetails for direct registry-based time extraction
   • Updates Yara scanner dependency to version 4.4.0 with LibreSSL integration
   • Adds delete_on_close option to OrcLib::FileStream for automatic cleanup after use

   +1 more show less

   • Adds DependencyLibrary support in OrcLib::ExtensionLibrary for advanced extension loading

   6 details in Everything

6. v10.2.3 Nov 16, 2023 · release notes

   DFIR ORC v10.2.3 introduces command timeout configuration, AuthCode signing support for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. PE files, and new internal library classes.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.2.3 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.2.3

   • Adds the timeout configuration attribute to the command element in OrcLib's configuration, allowing users to specify execution duration limits.
   • Enables authenticode signature verification for ARM PE files via the PeParser module in OrcLib.
   • Introduces new utility classes in OrcLib including ViewOfFile, Lock (for mutex handles), and enhanced PointerGuard/DescriptorGuard operators.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The CLI argument /MothershipHandle is renamed to /Mothership.
7. v10.2.2 Sep 19, 2023 · release notes

   New /ResurrectRecords flags on GetThis and FastFind; shadows_parser option for NTFSInfo; WolfLauncher offline key support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.2.2 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.2.2

   └──▷ USE IT
   Recover deleted files from the MFT by including resurrected records in GetThis output.
   shell copy

   GetThis /ResurrectRecords <path>

   Search for files using FastFind while also capturing entries that have been unlinked but are still in the MFT.
   shell copy

   FastFind /ResurrectRecords <path>

   Configure NTFSInfo to use a specific shadow copy parser and export ShadowCopyId in the stats file.
   shell copy

   NTFSInfo /shadows_parser <parser_name>

   • Adds /ResurrectRecords and resurrect options to OrcCommand: GetThis to include resurrected MFT records in output.
   • Adds /ResurrectRecords and resurrect options to OrcCommand: FastFind to include resurrected file entries during search.
   • Adds RecordInUse column to OrcCommand: GetThis output for better record state visibility.
   • Adds shadows_parser option to OrcCommand: NTFSInfo to switch shadow copy enumeration logic.
   • Adds ShadowCopyId column to the volstats.csv output generated by NTFSInfo.

   +1 more show less

   • Allows user to specify ORC_Offline's keys via WolfLauncher, enabling custom offline key configurations.

   6 details in Everything

8. v10.1.8 Sep 19, 2023 · release notes

   Allows specifying offline keys for ORC_Offline via WolfLauncher

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.1.8 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.1.8

9. v10.2.1 Jun 27, 2023 · release notes

   ORC v10.2.1 adds LocationSet wildcard exclusion support and optional XML Location config

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v10.2.1 https://github.com/DFIR-ORC/dfir-orc.git
   # already have the repo? check out this version:
   $ git checkout v10.2.1

   • Adds LocationSet support for wildcards in exclude paths
   • Makes the Location key optional in OrcLib configuration XML files

   2 details in Everything

10. v10.2.0 May 5, 2023 · release notes

    Orc adds /ResurrectRecords flag, NTFSInfo column ShadowCopyId, and optional error level to WolfLauncher Journal.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.2.0 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.2.0

    • OrcCommand GetThis gains /ResurrectRecords flag (alias resurrect) for ResurrectRecordMode support
    • OrcCommand FastFind gains /ResurrectRecords flag (alias resurrect)
    • OrcCommand NTFSInfo adds ShadowCopyId column to volstats.csv output
    • OrcCommand NTFSInfo accepts the shadows_parser option
    • WolfLauncher Journal supports optional error level via new config key

    5 details in Everything

11. v10.1.6 Feb 23, 2023 · release notes

    Adds /sample path matching to OrcCommand GetThis and job/command/archive timeouts to WolfLauncher Outline

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.6 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.1.6

    └──▷ TRY IT
    Configure job and timeout limits for WolfLauncher Outline tasks.
    copy

    $ OrcCommand WolfLauncher Outline /jobLimit 10 /commandTimeout 60 /archiveTimeout 300

    • OrcCommand GetThis now supports the /sample flag for path matching
    • WolfLauncher Outline adds configurable job limits
    • WolfLauncher Outline adds configurable command timeout
    • WolfLauncher Outline adds configurable archive timeout

    4 details in Everything

12. v10.1.1 Jun 20, 2022 · release notes

    DFIR ORC v10.1.1 adds /MothershipHandle CLI arg and GetAttributeNRExtents sanitization.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.1 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.1.1

    └──▷ HOW TO FIND IT
    Pass the Mothership handle during launch for integration workflows.
    📍dfir-orc wolf-launcher /MothershipHandle=<handle_value>
    • WolfLauncher now parses the new /MothershipHandle CLI argument for integration handling.
    • MFT parsing gains GetAttributeNRExtents with added sanitizing checks.
    • Log level for timeout messages is raised to critical via OrcCommand.

    3 details in Everything

13. v10.1.0 Mar 25, 2022 · release notes

    Adds individual cmake build flags to enable/disable DFIR ORC subcommands and adds security descriptor dump to NTFSInfo

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.1.0 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.1.0

    • NTFSInfo now includes a binary dump of the security descriptor in its output

    1 detail in Everything

14. v10.0.23 Jan 4, 2022 · release notes

    DFIR ORC v10.0.23 adds MountPoint to volstats.csv and DataSize to I30Info

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.23 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.23

    • OrcCommand NTFSInfo/FATInfo volstats.csv now includes the MountPoint column for better volume identification.

    1 detail in Everything

15. v10.0.22 Dec 2, 2021 · release notes

    v10.0.22 adds OrcLib enhancements for Yara rule usage, ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware. handling, and execution of extracted resources

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.22 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.22

    • Yara engine updated to version 4.1.3 via vcpkg.
    • OrcLib FileFind now uses specific matching Yara rule(s) as the description field.
    • OrcLib FileFind writes the attribute name (ADS) for data elements instead of generic identifiers.

    3 details in Everything

16. v10.0.20 Jul 2, 2021 · release notes

    Adds /nolimits[:<keyword>,...] flag to OrcCommand: WolfLauncher and configuration options in OrcLib.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.20 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.20

    └──▷ USE IT
    Run WolfLauncher without resource limits, optionally filtering keywords.
    shell copy

    dfir-orc WolfLauncher /nolimits

17. v10.0.19 Jun 1, 2021 · release notes

    GetSamples now enables autorunsc for all users; OrcLib updates Yara to 4.0.2.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.19 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.19

    • GetSamples now runs autorunsc.exe for all users on the system
    • OrcLib Yara updated to version 4.0.2

    2 details in Everything

18. v10.0.17 Feb 10, 2021 · release notes

    Adds -SSDeep switch and /log:* compatibility improvements for DFIR ORC

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.17 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.17

    └──▷ USE IT
    Run the DFIR ORC CI build process with SSDeep analysis enabled.
    shell copy

    tools/ci/build.ps1 -SSDeep

    • Adds -SSDeep parameter to the CI build workflow for fuzzy hashing support
    • OrcCommand now ignores the upcoming /log:* switch for better CLI compatibility
    • WolfLauncher adds compatibility with console configuration mode

    3 details in Everything

19. v10.0.16 Nov 9, 2020 · release notes

    DFIR ORC v10.0.16 adds NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. SecurityDirectorySize/SignatureSize fields and pre-Win10 OS tags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.16 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.16

    • OrcCommand NtfsInfo now includes SecurityDirectorySize and SecurityDirectorySignatureSize in its output for detailed NTFS security analysis
    • OrcLib SystemDetails adds Windows and RTM tags to identify pre-Windows 10 operating system versions

    2 details in Everything

20. v10.0.15 Sep 29, 2020 · release notes

    DFIR ORC v10.0.15 enables {ProfileDirectory} expansion in location and removes DFIR-OrcComputer env var truncation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.15 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.15

    • Changes DFIR-OrcComputer environment variable behavior to no longer truncate it, carrying the /computer value to child processes

    1 detail in Everything

21. v10.0.14 Jul 31, 2020 · release notes

    DFIR ORC v10.0.14 adds Registry support to OrcLib and updates outline data in WolfLauncher

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.14 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.14

    └──▷ USE IT
    Bypass vcpkg automatic dependency upgrades during build by setting the CMake option.
    shell copy

    cmake -DORC_DOWNLOADS_ONLY=ON -Dvcpkg_NO_UPGRADE=ON ../src

    • Adds Registry class in OrcLib to read values from the registry
    • Adds execution timestamp and invocation command line to WolfLauncher outline output
    • Adds CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., physical memory, ProcessArea, environment, and QFE list to SystemIdentity/SystemDetails
    • Adds XML support for Begin/End of collections via OrcLib

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The JSON cmake option is removed; build configurations using -DJSON=... will fail.
22. v10.0.12 Jun 10, 2020 · release notes

    WolfLauncher external logs now include archive creation time and file size; ORC_BUILD_JSON defaults to ON

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.12 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.12

    • WolfLauncher external log output now includes archive_creation_time and file_size fields for created archives.
    • The ORC_BUILD_JSON environment variable now defaults to ON, enabling JSON build output without explicit configuration.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ORC_BUILD_JSON now defaults to ON. If your build pipeline relies on non-JSON (e.g., XML or plain text) output and does not explicitly set ORC_BUILD_JSON=OFF, it will now produce JSON.
23. v10.0.9 Mar 19, 2020 · release notes

    DFIR ORC v10.0.9 adds ExtractData subcommand, NTFSUtil BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. metadata support, and OrcParquet CSV quoting fixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v10.0.9 https://github.com/DFIR-ORC/dfir-orc.git
    # already have the repo? check out this version:
    $ git checkout v10.0.9

    • GetThis uses ; (semicolon) as YARA rule delimiter instead of the previous default
    • Adds ExtractData subcommand to OrcCommand for raw data extraction
    • NTFSUtil displays BitLocker metadata via the new /BitLocker option
    • Configurable meta product name and version using the new configuration option
    • Customizable icons for ORC and FastFind executables via new build options

    +1 more show less

    • Desired file names can now be specified for extension libraries

    6 details in Everything