Using DFIR-ORC without Compression

[elad-levi-cyberark]

Hi!

I have noticed that <archive> has option for compression="None".

The problem is that it's still 7zip or zip, it would be nice if archive could be configure to save to directory (no compression).

[fabienfl-orc]

Thanks for bringing this up. At the moment, I'm not entirely sure how to implement this feature, but I don't believe it would be a significant amount of work. Unfortunately, time is a bit tight right now.

As things currently stand, DFIR-Orc commands use a temporary directory before "WolfLauncher" gathers the output files to create the final archive. I think the approach could involve simply moving the files into the specified directory and skipping their removal.

We are planning to build ORC to use MLA as the output archive, and I’ll try to keep this feature in mind during that process.

[elad-levi-cyberark]

Thanks for bringing this up. At the moment, I'm not entirely sure how to implement this feature, but I don't believe it would be a significant amount of work. Unfortunately, time is a bit tight right now.

As things currently stand, DFIR-Orc commands use a temporary directory before "WolfLauncher" gathers the output files to create the final archive. I think the approach could involve simply moving the files into the specified directory and skipping their removal.

We are planning to build ORC to use MLA as the output archive, and I’ll try to keep this feature in mind during that process.

What do you mean by MLA? (I'm not a compression professional and online searches didn't yield anything related)

[sc-anssi]

Sorry, we were talking about this project: https://github.com/ANSSI-FR/MLA