At CERT Intrinsec, DFIR-ORC is part of our incident response tooling. It helps us collect forensic data in a consistent format, but the encrypted archives still need to be decrypted before they can enter our processing chain.
Our processing workflow is complex and runs across different environments. In practice, we need to decrypt ORC archives on both Windows and Linux systems, quickly, and without adding avoidable deployment constraints.
This is why we developed OrcDecryptNet : a .NET 8 command-line tool to decrypt DFIR-ORC .p7b archives.
Why we built it
The goal was simple: have a compiled, cross-platform decryptor that fits our processing chain and is easy to run on both Windows and Linux.
Using .NET gives us:
- a compiled binary that is easy to deploy;
- support for multiple platforms from the same codebase;
- good runtime performance for large archives;
- simple integration in scripts and automation pipelines.
On Windows, OrcDecryptNet also supports a small convenience feature for authorized workstations: private key information can be stored using DPAPI. This avoids repeatedly passing the same key material during routine operations while keeping the storage tied to the Windows user account.
What it does
OrcDecryptNet decrypts DFIR-ORC archives in .p7b format. It requires a private key in PFX / PKCS#12 format.
It can be used in two ways:
- manual mode, available on Windows and Linux;
- Windows credential mode, using DPAPI for local credential storage on authorized workstations.
Manual mode:
OrcDecryptNet <archive_path> <output_folder> <private_key.pfx> [password] [-v|--verbose]Windows setup with DPAPI:
OrcDecryptNet --setup C:\Keys\private.pfxAfter setup, decrypting an archive can be as simple as:
OrcDecryptNet C:\Data\archive.p7bAn output folder can also be specified:
OrcDecryptNet C:\Data\archive.p7b C:\OutputSecurity notes
On Windows, stored credentials are protected with DPAPI and tied to the current user account. This is useful on authorized analyst workstations, but private keys and passphrases must still be handled according to internal security policies.
On Linux, credentials are not stored by OrcDecryptNet. The PFX path and password must be provided explicitly. Stored Windows credentials can be removed with:
OrcDecryptNet --clear-credentialsBuild
Requirements:
- .NET 8 SDK;
- Visual Studio 2022 or the
dotnetCLI.
Build from the repository root:
dotnet build OrcDecryptNet.sln -c ReleaseLinks
- DFIR-ORC project: https://github.com/dfir-orc
- Official Python decryptor: https://github.com/DFIR-ORC/orc-decrypt
- OrcDecryptNet repository: https://github.com/Intrinsec/OrcDecryptNet
