cyber.hendryadrian.com
Security News · intrinsec.com

Intrinsec Introduces OrcDecryptNet, a Cross-Platform DFIR-ORC Archive Decryptor

· Original article ↗

Summary

Intrinsec introduced OrcDecryptNet, a .NET 8 command-line tool for decrypting DFIR-ORC .p7b archives on Windows and Linux, with optional Windows DPAPI credential storage.

Key points

  • OrcDecryptNet decrypts DFIR-ORC archives in .p7b format and requires a private key in PFX/PKCS#12 format.
  • Manual decryption is supported on Windows and Linux.
  • On authorized Windows workstations, users can store private-key information with DPAPI, tied to the current Windows user account.
  • On Linux, credentials are not stored by the tool; the PFX path and password must be provided explicitly.
  • The tool is built with .NET 8 and is intended for integration into scripts and processing workflows.

Article Details

Event Type
Release of OrcDecryptNet, a cross-platform .NET command-line tool for decrypting DFIR-ORC archives.
Impact
Enables authorized analysts to decrypt DFIR-ORC .p7b archives on Windows and Linux using a PFX/PKCS#12 private key. On Windows, DPAPI can store credentials for the current user; OrcDecryptNet does not store credentials on Linux.

Vendors

IntrinsecAt CERT Intrinsec, DFIR-ORC is part of our incident response tooling. It helps us collect forensic data in a consistent format, but the encrypted archives still need to be decrypted before they can enter our processing

Products

DFIR-ORCAt CERT Intrinsec, DFIR-ORC is part of our incident response tooling. It helps us collect forensic data in a consistent format, but the encrypted archives still need to be decrypted before they can enter our processing

Tools

OrcDecryptNetThis is why we developed OrcDecryptNet : a .NET 8 command-line tool to decrypt DFIR-ORC .p7b archives.

Related Articles