https://cybertoolchain.io/tools/dfir-orc New releases and features in DFIR ORC, tracked by The Cyber Toolchain. en Fri, 17 Apr 2026 10:32:25 GMT https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.3.0 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.3.0 Fri, 17 Apr 2026 10:32:25 GMT DFIR ORC v10.3.0 introduces OrcCapsule loader, WolfLauncher /MultipleInstance, and several new CLI options • Adds `OrcCapsule` binary loader that selects the most capable embedded DFIR-ORC binary for the host environment (x64, x86, x64-xp, x86-xp, arm64) • Adds `/MultipleInstance` execution option to `WolfLauncher` • Allows default multiple running instances of OrcOffline in `WolfLauncher` • Adds `SampleNameFormat` option to `GetThis` for custom naming schemes • Adds `timezoneinfo` to `Outcome` output • Makes `ToolEmbed` `/embed` option more flexible and adds `/force` overwrite capability • Updates `WolfLauncher` CLI with `CommandTimeout` and `ArchiveTimeout` options Breaking changes: • DFIR-ORC output files and directories ACLs no longer inherit permissions; they are now restricted to the current user and administrators • ToolEmbed options `input`, `run32`, and `run64` are deprecated Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.7 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.7 Wed, 26 Mar 2025 18:14:28 GMT DFIR ORC v10.2.7 adds physicalmemory and diskfree archive conditions for WolfLauncher. • Adds `physicalmemory` condition to WolfLauncher archive configuration • Adds `diskfree` configurable requirement to WolfLauncher archive configuration • Enables ARM64 support for extension libraries Breaking changes: • WolfLauncher outcome command field "type" is renamed to "source" Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.5 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.5 Wed, 12 Jun 2024 10:47:45 GMT Adds HypervisorType detection, SMB share cleanup option, and RunId pattern to Outline for DFIR ORC v10.2.5 • Adds HypervisorType support to detect hypervisor environments on target systems. • Adds `{RunId}` pattern to OutputSpec.ApplyPattern for identifying execution runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.4 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.4 Thu, 08 Feb 2024 13:03:09 GMT ORC v10.2.4 adds install/shutdown time extraction from registry, Yara 4.4.0 support, and several library enhancements. • Adds `computer_name` field to `OrcCommand` WolfLauncher Outline for host identification • Adds `SystemIdentity.install_date`, `install_time`, and `shutdown_time` fields to capture system timeline events • Adds `GetInstallDateFromRegistry`, `GetInstallTimeFromRegistry`, and `GetShutdownTimeFromRegistry` functions in `OrcLib::SystemDetails` for direct registry-based time extraction • Updates Yara scanner dependency to version 4.4.0 with LibreSSL integration • Adds `delete_on_close` option to `OrcLib::FileStream` for automatic cleanup after use • Adds `DependencyLibrary` support in `OrcLib::ExtensionLibrary` for advanced extension loading Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.3 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.3 Thu, 16 Nov 2023 11:09:14 GMT DFIR ORC v10.2.3 introduces command timeout configuration, AuthCode signing support for ARM PE files, and new internal library classes. • Adds the `timeout` configuration attribute to the `command` element in OrcLib's configuration, allowing users to specify execution duration limits. • Enables authenticode signature verification for ARM PE files via the `PeParser` module in OrcLib. • Introduces new utility classes in OrcLib including `ViewOfFile`, `Lock` (for mutex handles), and enhanced `PointerGuard`/`DescriptorGuard` operators. Breaking changes: • The CLI argument `/MothershipHandle` is renamed to `/Mothership`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.2 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.2 Tue, 19 Sep 2023 11:44:17 GMT New /ResurrectRecords flags on GetThis and FastFind; 'shadows_parser' option for NTFSInfo; WolfLauncher offline key support • Adds `/ResurrectRecords` and `resurrect` options to `OrcCommand: GetThis` to include resurrected MFT records in output. • Adds `/ResurrectRecords` and `resurrect` options to `OrcCommand: FastFind` to include resurrected file entries during search. • Adds `RecordInUse` column to `OrcCommand: GetThis` output for better record state visibility. • Adds `shadows_parser` option to `OrcCommand: NTFSInfo` to switch shadow copy enumeration logic. • Adds `ShadowCopyId` column to the `volstats.csv` output generated by `NTFSInfo`. • Allows user to specify ORC_Offline's keys via `WolfLauncher`, enabling custom offline key configurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.8 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.8 Tue, 19 Sep 2023 08:32:36 GMT Allows specifying offline keys for ORC_Offline via WolfLauncher • `OrcCommand` in `WolfLauncher` now accepts user-specified keys for ORC_Offline. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.1 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.1 Tue, 27 Jun 2023 10:06:08 GMT ORC v10.2.1 adds 'LocationSet' wildcard exclusion support and optional XML Location config • Adds `LocationSet` support for wildcards in exclude paths • Makes the `Location` key optional in OrcLib configuration XML files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.0 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.2.0 Fri, 05 May 2023 12:10:45 GMT Orc adds /ResurrectRecords flag, NTFSInfo column ShadowCopyId, and optional error level to WolfLauncher Journal. • OrcCommand GetThis gains `/ResurrectRecords` flag (alias `resurrect`) for ResurrectRecordMode support • OrcCommand FastFind gains `/ResurrectRecords` flag (alias `resurrect`) • OrcCommand NTFSInfo adds 'ShadowCopyId' column to volstats.csv output • OrcCommand NTFSInfo accepts the "shadows_parser" option • WolfLauncher Journal supports optional error level via new config key Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.6 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.6 Thu, 23 Feb 2023 10:57:02 GMT Adds /sample path matching to OrcCommand GetThis and job/command/archive timeouts to WolfLauncher Outline • OrcCommand GetThis now supports the `/sample` flag for path matching • WolfLauncher Outline adds configurable job limits • WolfLauncher Outline adds configurable command timeout • WolfLauncher Outline adds configurable archive timeout Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.1 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.1 Mon, 20 Jun 2022 16:59:31 GMT DFIR ORC v10.1.1 adds `/MothershipHandle` CLI arg and `GetAttributeNRExtents` sanitization. • `WolfLauncher` now parses the new `/MothershipHandle` CLI argument for integration handling. • MFT parsing gains `GetAttributeNRExtents` with added sanitizing checks. • Log level for timeout messages is raised to critical via `OrcCommand`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.0 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.1.0 Fri, 25 Mar 2022 13:13:17 GMT Adds individual cmake build flags to enable/disable DFIR ORC subcommands and adds security descriptor dump to NTFSInfo • NTFSInfo now includes a binary dump of the security descriptor in its output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.0.23 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.0.23 Tue, 04 Jan 2022 09:09:07 GMT DFIR ORC v10.0.23 adds MountPoint to volstats.csv and DataSize to I30Info • `OrcCommand` NTFSInfo/FATInfo `volstats.csv` now includes the `MountPoint` column for better volume identification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.0.22 https://github.com/DFIR-ORC/dfir-orc/releases/tag/v10.0.22 Thu, 02 Dec 2021 16:12:32 GMT v10.0.22 adds OrcLib enhancements for Yara rule usage, ADS handling, and execution of extracted resources • Yara engine updated to version 4.1.3 via vcpkg. • OrcLib FileFind now uses specific matching Yara rule(s) as the description field. • OrcLib FileFind writes the attribute name (ADS) for data elements instead of generic identifiers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dfir-orc