search

DFIR-ORC / dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows
https://dfir-orc.github.io
GNU Lesser General Public License v2.1
370 stars 42 forks source link

Problem getting DFIR-Orc.exe #70

Closed Ophelien17 closed 1 year ago

Ophelien17 commented 1 year ago

Hello, I am trying to obtain the DFIR-Orc.exe binary but I have some errors. I follow the tutorial ; So I have clonned the dfir-orc-config repository and copy binaries DFIR-ORC_x86.exe and DFIR-ORC_x64.exe in the tools folder. But when I run 

.\Configure.cmd

I have these errors :

Configuring Orc (.\output\DFIR-Orc.exe) with config: .\config ToolEmbed v10.1.4

Embed/Extract configuration data and tools

2022-11-08T15:12:37.719Z [I] ** Backtrace Start ** 2022-11-08T15:12:37.659Z [D] Enable stdout redirection with WriteConsole 2022-11-08T15:12:37.662Z [D] Library class Orc::NtDllExtension is not yet loaded 2022-11-08T15:12:37.662Z [D] TryLoad for references 'ntdll.dll' 2022-11-08T15:12:37.662Z [D] ExtensionLibrary: Loading value 'ntdll.dll' 2022-11-08T15:12:37.667Z [D] Opening 'C:\Windows\System32\cmd.exe' for resource 'ntdll.dll' of type 'VALUES' 2022-11-08T15:12:37.667Z [D] Opening 'C:\Windows\explorer.exe' for resource 'ntdll.dll' of type 'VALUES' 2022-11-08T15:12:37.667Z [D] ExtensionLibrary: Loaded 'ntdll.dll' successfully 2022-11-08T15:12:37.667Z [D] ExtensionLibrary: Loaded 'C:\WINDOWS\SYSTEM32\ntdll.dll' successfully 2022-11-08T15:12:37.667Z [D] TryLoad succeeded for reference 'ntdll.dll' 2022-11-08T15:12:37.667Z [D] Library class Orc::Kernel32Extension is not yet loaded 2022-11-08T15:12:37.667Z [D] TryLoad for references 'kernel32.dll' 2022-11-08T15:12:37.667Z [D] ExtensionLibrary: Loading value 'kernel32.dll' 2022-11-08T15:12:37.672Z [D] Opening 'C:\Windows\System32\cmd.exe' for resource 'kernel32.dll' of type 'VALUES' 2022-11-08T15:12:37.672Z [D] Opening 'C:\Windows\explorer.exe' for resource 'kernel32.dll' of type 'VALUES' 2022-11-08T15:12:37.672Z [D] ExtensionLibrary: Loaded 'kernel32.dll' successfully 2022-11-08T15:12:37.672Z [D] ExtensionLibrary: Loaded 'C:\WINDOWS\System32\KERNEL32.DLL' successfully 2022-11-08T15:12:37.672Z [D] TryLoad succeeded for reference 'kernel32.dll' 2022-11-08T15:12:37.672Z [D] Library class Orc::XmlLiteExtension is not yet loaded 2022-11-08T15:12:37.672Z [D] TryLoad for references 'xmllite.dll' 2022-11-08T15:12:37.672Z [D] ExtensionLibrary: Loading value 'xmllite.dll' 2022-11-08T15:12:37.676Z [D] Opening 'C:\Windows\System32\cmd.exe' for resource 'xmllite.dll' of type 'VALUES' 2022-11-08T15:12:37.677Z [D] Opening 'C:\Windows\explorer.exe' for resource 'xmllite.dll' of type 'VALUES' 2022-11-08T15:12:37.677Z [D] ExtensionLibrary: Loaded 'xmllite.dll' successfully 2022-11-08T15:12:37.677Z [D] ExtensionLibrary: Loaded 'C:\WINDOWS\SYSTEM32\XmlLite.dll' successfully 2022-11-08T15:12:37.677Z [D] TryLoad succeeded for reference 'xmllite.dll' 2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\handle.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.] 2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\Tcpvcon.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.] 2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\PsService.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.] 2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\Listdlls.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.] 2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\DumpIt.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.] 2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\winpmem.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.] 2022-11-08T15:12:37.731Z [I] ** Backtrace End **** 2022-11-08T15:12:37.719Z [C] Failed to parse xml configuration [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]

Any advices ? Thank you for your help !

Ophelien17 commented 1 year ago

ok it's my fault I didn't see that it was packages to add