{"id":232689,"date":"2026-11-03T10:24:45","date_gmt":"2026-11-03T10:24:45","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=232689"},"modified":"2026-11-05T09:52:25","modified_gmt":"2026-11-05T09:52:25","slug":"orcdecryptnet-a-net-decryptor-for-dfir-orc-archives","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/","title":{"rendered":"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"232689\" class=\"elementor elementor-232689\" data-elementor-settings=\"{&quot;element_pack_global_tooltip_width&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_padding&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true}}\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ad6d96e e-flex e-con-boxed e-con e-parent\" data-id=\"ad6d96e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d7e597a elementor-widget elementor-widget-text-editor\" data-id=\"d7e597a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p dir=\"auto\" data-sourcepos=\"3:1-3:225\">At CERT Intrinsec, <strong>DFIR-ORC<\/strong> is part of our incident response tooling. It helps us collect forensic data in a consistent format, but the encrypted archives still need to be decrypted before they can enter our processing chain.<\/p><p dir=\"auto\" data-sourcepos=\"5:1-5:216\">Our processing workflow is complex and runs across different environments. In practice, we need to decrypt ORC archives on both Windows and Linux systems, quickly, and without adding avoidable deployment constraints.<\/p><p dir=\"auto\" data-sourcepos=\"7:1-7:119\">This is why we developed <strong data-sourcepos=\"7:26-7:42\">OrcDecryptNet<\/strong> : a .NET 8 command-line tool to decrypt DFIR-ORC <code data-sourcepos=\"7:104-7:109\">.p7b<\/code> archives.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9afda91 e-flex e-con-boxed e-con e-parent\" data-id=\"9afda91\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-21999f0 elementor-widget elementor-widget-heading\" data-id=\"21999f0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why we built it<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-707a0dc elementor-widget elementor-widget-text-editor\" data-id=\"707a0dc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p dir=\"auto\" data-sourcepos=\"11:1-11:139\">The goal was simple: have a compiled, cross-platform decryptor that fits our processing chain and is easy to run on both Windows and Linux.<\/p><p dir=\"auto\" data-sourcepos=\"13:1-13:20\">Using .NET gives us:<\/p><ul dir=\"auto\" data-sourcepos=\"15:1-18:57\"><li data-sourcepos=\"15:1-15:43\">a compiled binary that is easy to deploy;<\/li><li data-sourcepos=\"16:1-16:56\">support for multiple platforms from the same codebase;<\/li><li data-sourcepos=\"17:1-17:46\">good runtime performance for large archives;<\/li><li data-sourcepos=\"18:1-18:57\">simple integration in scripts and automation pipelines.<\/li><\/ul><p dir=\"auto\" data-sourcepos=\"20:1-20:286\">On Windows, OrcDecryptNet also supports a small convenience feature for authorized workstations: private key information can be stored using DPAPI. This avoids repeatedly passing the same key material during routine operations while keeping the storage tied to the Windows user account.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-77f16cf elementor-widget elementor-widget-heading\" data-id=\"77f16cf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What it does<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-effed1e elementor-widget elementor-widget-text-editor\" data-id=\"effed1e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p dir=\"auto\" data-sourcepos=\"24:1-24:109\">OrcDecryptNet decrypts DFIR-ORC archives in <code data-sourcepos=\"24:45-24:50\">.p7b<\/code> format. It requires a private key in PFX \/ PKCS#12 format.<\/p><p dir=\"auto\" data-sourcepos=\"26:1-26:27\">It can be used in two ways:<\/p><ul dir=\"auto\" data-sourcepos=\"28:1-29:95\"><li data-sourcepos=\"28:1-28:46\">manual mode, available on Windows and Linux;<\/li><li data-sourcepos=\"29:1-29:95\">Windows credential mode, using DPAPI for local credential storage on authorized workstations.<\/li><\/ul><p dir=\"auto\" data-sourcepos=\"31:1-31:12\">Manual mode:<\/p><div class=\"gl-relative markdown-code-block js-markdown-code\"><pre id=\"code-101\" class=\"code highlight js-syntax-highlight language-shell code-syntax-highlight-theme\" data-sourcepos=\"33:1-35:3\" data-canonical-lang=\"bash\"><code><span id=\"LC1\" class=\"line\" data-lang=\"shell\">OrcDecryptNet &lt;archive_path&gt; &lt;output_folder&gt; &lt;private_key.pfx&gt; <span class=\"o\">[<\/span>password] <span class=\"o\">[<\/span><span class=\"nt\">-v<\/span>|--verbose]<\/span><\/code><\/pre><button class=\"btn btn-default btn-md gl-button btn-icon has-tooltip\" type=\"button\" data-title=\"Copy to clipboard\" aria-label=\"Copy to clipboard\" data-clipboard-target=\"pre#code-101\"><\/button><\/div><p dir=\"auto\" data-sourcepos=\"37:1-37:25\">Windows setup with DPAPI:<\/p><div class=\"gl-relative markdown-code-block js-markdown-code\"><pre id=\"code-102\" class=\"code highlight js-syntax-highlight language-shell code-syntax-highlight-theme\" data-sourcepos=\"39:1-41:3\" data-canonical-lang=\"bash\"><code><span id=\"LC1\" class=\"line\" data-lang=\"shell\">OrcDecryptNet <span class=\"nt\">--setup<\/span> C:<span class=\"se\">\\K<\/span>eys<span class=\"se\">\\p<\/span>rivate.pfx<\/span><\/code><\/pre><button class=\"btn btn-default btn-md gl-button btn-icon has-tooltip\" type=\"button\" data-title=\"Copy to clipboard\" aria-label=\"Copy to clipboard\" data-clipboard-target=\"pre#code-102\"><\/button><\/div><p dir=\"auto\" data-sourcepos=\"43:1-43:55\">After setup, decrypting an archive can be as simple as:<\/p><div class=\"gl-relative markdown-code-block js-markdown-code\"><pre id=\"code-103\" class=\"code highlight js-syntax-highlight language-shell code-syntax-highlight-theme\" data-sourcepos=\"45:1-47:3\" data-canonical-lang=\"bash\"><code><span id=\"LC1\" class=\"line\" data-lang=\"shell\">OrcDecryptNet C:<span class=\"se\">\\D<\/span>ata<span class=\"se\">\\a<\/span>rchive.p7b<\/span><\/code><\/pre><button class=\"btn btn-default btn-md gl-button btn-icon has-tooltip\" type=\"button\" data-title=\"Copy to clipboard\" aria-label=\"Copy to clipboard\" data-clipboard-target=\"pre#code-103\"><\/button><\/div><p dir=\"auto\" data-sourcepos=\"49:1-49:39\">An output folder can also be specified:<\/p><div class=\"gl-relative markdown-code-block js-markdown-code\"><pre id=\"code-104\" class=\"code highlight js-syntax-highlight language-shell code-syntax-highlight-theme\" data-sourcepos=\"51:1-53:3\" data-canonical-lang=\"bash\"><code><span id=\"LC1\" class=\"line\" data-lang=\"shell\">OrcDecryptNet C:<span class=\"se\">\\D<\/span>ata<span class=\"se\">\\a<\/span>rchive.p7b C:<span class=\"se\">\\O<\/span>utput<\/span><\/code><\/pre><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fd50f67 elementor-widget elementor-widget-heading\" data-id=\"fd50f67\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Security notes<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1ad2583 elementor-widget elementor-widget-text-editor\" data-id=\"1ad2583\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p dir=\"auto\" data-sourcepos=\"57:1-57:240\">On Windows, stored credentials are protected with DPAPI and tied to the current user account. This is useful on authorized analyst workstations, but private keys and passphrases must still be handled according to internal security policies.<\/p><p dir=\"auto\" data-sourcepos=\"59:1-60:47\">On Linux, credentials are not stored by OrcDecryptNet. The PFX path and password must be provided explicitly. Stored Windows credentials can be removed with:<\/p><div class=\"gl-relative markdown-code-block js-markdown-code\"><pre id=\"code-105\" class=\"code highlight js-syntax-highlight language-shell code-syntax-highlight-theme\" data-sourcepos=\"62:1-64:3\" data-canonical-lang=\"bash\"><code><span id=\"LC1\" class=\"line\" data-lang=\"shell\">OrcDecryptNet <span class=\"nt\">--clear-credentials<\/span><\/span><\/code><\/pre><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-83f2204 elementor-widget elementor-widget-heading\" data-id=\"83f2204\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Build<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ed47854 elementor-widget elementor-widget-text-editor\" data-id=\"ed47854\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p dir=\"auto\" data-sourcepos=\"68:1-68:13\">Requirements:<\/p><ul dir=\"auto\" data-sourcepos=\"70:1-71:41\"><li data-sourcepos=\"70:1-70:13\">.NET 8 SDK;<\/li><li data-sourcepos=\"71:1-71:41\">Visual Studio 2022 or the <code data-sourcepos=\"71:29-71:36\">dotnet<\/code> CLI.<\/li><\/ul><p dir=\"auto\" data-sourcepos=\"73:1-73:31\">Build from the repository root:<\/p><div class=\"gl-relative markdown-code-block js-markdown-code\"><pre id=\"code-106\" class=\"code highlight js-syntax-highlight language-shell code-syntax-highlight-theme\" data-sourcepos=\"75:1-77:3\" data-canonical-lang=\"bash\"><code><span id=\"LC1\" class=\"line\" data-lang=\"shell\">dotnet build OrcDecryptNet.sln <span class=\"nt\">-c<\/span> Release<\/span><\/code><\/pre><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1c8e5b2 elementor-widget elementor-widget-heading\" data-id=\"1c8e5b2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Links<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c254cc7 elementor-widget elementor-widget-text-editor\" data-id=\"c254cc7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<ul><li data-sourcepos=\"81:1-81:48\">DFIR-ORC project: <a href=\"https:\/\/github.com\/dfir-orc\" target=\"_blank\" rel=\"nofollow noreferrer noopener\" data-sourcepos=\"81:22-81:48\">https:\/\/github.com\/dfir-orc<\/a><\/li><li data-sourcepos=\"82:1-82:68\">Official Python decryptor: <a href=\"https:\/\/github.com\/DFIR-ORC\/orc-decrypt\" target=\"_blank\" rel=\"nofollow noreferrer noopener\" data-sourcepos=\"82:30-82:68\">https:\/\/github.com\/DFIR-ORC\/orc-decrypt<\/a><\/li><li data-sourcepos=\"83:1-83:64\">OrcDecryptNet repository: <a href=\"https:\/\/github.com\/Intrinsec\/OrcDecryptNet\">https:\/\/github.com\/Intrinsec\/OrcDecryptNet<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>At CERT Intrinsec, DFIR-ORC is part of our incident response tooling. It helps us collect forensic data in a consistent format, but the encrypted archives still need to be decrypted before they can enter our processing chain.<br \/>\nOur processing workflow is complex and runs across different environments. In practice, we need to decrypt ORC archives on both Windows and Linux systems, quickly, and without adding avoidable deployment constraints.<br \/>\nThis is why we developed OrcDecryptNet: a .NET 8 command-line tool to decrypt DFIR-ORC .p7b archives.<\/p>","protected":false},"author":55,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-232689","post","type-post","status-publish","format-standard","hentry","category-cert"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.6 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>OrcDecryptNet: a .NET decryptor for DFIR-ORC archives - INTRINSEC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives\" \/>\n<meta property=\"og:description\" content=\"At CERT Intrinsec, DFIR-ORC is part of our incident response tooling. It helps us collect forensic data in a consistent format, but the encrypted archives still need to be decrypted before they can enter our processing chain. Our processing workflow is complex and runs across different environments. In practice, we need to decrypt ORC archives on both Windows and Linux systems, quickly, and without adding avoidable deployment constraints. This is why we developed OrcDecryptNet : a .NET 8 command-line tool to decrypt DFIR-ORC .p7b archives.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-03T10:24:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-05T09:52:25+00:00\" \/>\n<meta name=\"author\" content=\"CERT Intrinsec\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"CERT Intrinsec\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/\"},\"author\":{\"name\":\"CERT Intrinsec\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/1ec04601123170d245331ea69b78356e\"},\"headline\":\"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives\",\"datePublished\":\"2026-11-03T10:24:45+00:00\",\"dateModified\":\"2026-11-05T09:52:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/\"},\"wordCount\":356,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"articleSection\":[\"CERT\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/\",\"name\":\"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"datePublished\":\"2026-11-03T10:24:45+00:00\",\"dateModified\":\"2026-11-05T09:52:25+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/1ec04601123170d245331ea69b78356e\",\"name\":\"CERT Intrinsec\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g\",\"caption\":\"CERT Intrinsec\"},\"sameAs\":[\"https:\\\/\\\/www.intrinsec.com\\\/category\\\/cert\\\/\"],\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/certintrinsec\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives - INTRINSEC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/","og_locale":"en_US","og_type":"article","og_title":"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives","og_description":"At CERT Intrinsec, DFIR-ORC is part of our incident response tooling. It helps us collect forensic data in a consistent format, but the encrypted archives still need to be decrypted before they can enter our processing chain. Our processing workflow is complex and runs across different environments. In practice, we need to decrypt ORC archives on both Windows and Linux systems, quickly, and without adding avoidable deployment constraints. This is why we developed OrcDecryptNet : a .NET 8 command-line tool to decrypt DFIR-ORC .p7b archives.","og_url":"https:\/\/www.intrinsec.com\/en\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/","og_site_name":"INTRINSEC","article_published_time":"2026-11-03T10:24:45+00:00","article_modified_time":"2026-11-05T09:52:25+00:00","author":"CERT Intrinsec","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"CERT Intrinsec","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/"},"author":{"name":"CERT Intrinsec","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/1ec04601123170d245331ea69b78356e"},"headline":"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives","datePublished":"2026-11-03T10:24:45+00:00","dateModified":"2026-11-05T09:52:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/"},"wordCount":356,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"articleSection":["CERT"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/","url":"https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/","name":"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"datePublished":"2026-11-03T10:24:45+00:00","dateModified":"2026-11-05T09:52:25+00:00","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/orcdecryptnet-a-net-decryptor-for-dfir-orc-archives\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"OrcDecryptNet: a .NET decryptor for DFIR-ORC archives"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/1ec04601123170d245331ea69b78356e","name":"Intrinsic CERT","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/48491cc0395b3eed17e56104e0ad5a174d5133baeb103718533f3bc781e03778?s=96&d=retro&r=g","caption":"CERT Intrinsec"},"sameAs":["https:\/\/www.intrinsec.com\/category\/cert\/"],"url":"https:\/\/www.intrinsec.com\/en\/author\/certintrinsec\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/232689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=232689"}],"version-history":[{"count":13,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/232689\/revisions"}],"predecessor-version":[{"id":232726,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/232689\/revisions\/232726"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=232689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=232689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=232689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}