search

DFIR-ORC / dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows
https://dfir-orc.github.io
GNU Lesser General Public License v2.1
370 stars 42 forks source link

dfir-orc configuration: xml parsing issue #45

Closed ghost closed 3 years ago

ghost commented 3 years ago

Hello, after compiling successfully unconfigured dfir-orc binary, when trying to configure it under admin powershell prompt, I have an issue.

** Before executing configure.ps1, here is the steps followed: PS C:\Users\dib4> git clone "https://github.com/dfir-orc/dfir-orc-config.git" Cloning into 'dfir-orc-config'... remote: Enumerating objects: 121, done. Receiving objects: 52% (63/121)79/79), done. Receiving objects: 100% (121/121), 50.50 remote: Compressing objects: 30% (20/65) esolving deltas: 100% (34/34), done. remote: Compressing objects: 100% (65/65), done. remote: Total 121 (delta 22), reused 63 (delta 14), pack-reused 42 PS C:\Users\dib4> cd .\dfir-orc-config\ PS C:\Users\dib4\dfir-orc-config> copy ..\dfir-orc\build-x86\MinSizeRel\DFIR-Orc_x86.exe .\tools PS C:\Users\dib4\dfir-orc-config> copy ..\dfir-orc\build-x64\MinSizeRel\DFIR-Orc_x64.exe .\tools PS C:\Users\dib4\dfir-orc-config> copy ..\autorunsc.exe .\tools PS C:\Users\dib4\dfir-orc-config> dir tools Directory: C:\Users\dib4\dfir-orc-config\tools Mode LastWriteTime Length Name

-a---- 03/06/2021 14:46 708984 autorunsc.exe -a---- 03/06/2021 08:59 7981568 DFIR-Orc_x64.exe -a---- 03/06/2021 09:27 6416384 DFIR-Orc_x86.exe

** Executing the configuration script: PS C:\Users\dib4\dfir-orc-config> .\configure.ps1 Found ToolEmbed configuration: '.\config/DFIR-ORC_embed.xml' ToolEmbed v10.1.0-rc5

Embed/Extract configuration data and tools

2021-06-03T13:46:46.188Z [C] Failed to parse xml configuration [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.] Move-Item : Cannot find path 'C:\Users\dib4\dfir-orc-config\output\DFIR-Orc.exe' because it does not exist. At C:\Users\dib4\dfir-orc-config\configure.ps1:163 char:9

What could be the problem ?

Many thanks in advance for your help and thanks a lot for developping and giving to community a such tool suite

Kindest regards Dib4

ghost commented 3 years ago

Hello, I answer to myself.

The issue : some programs was missing in .\tools directory.

To fix issue :

  1. edit .\config\DFIR-ORC_embed.xml
  2. remove program line
  3. save
  4. launch again .\configure.ps1

Suggestion: change error message to be more accurate.

Hope this will help somebody ;-)

Kindest Regards Dib4