Fix #11: GetSectors dumps the host's sectors instead of those of the …

…target offline disk image.
DFIR-ORC · Mar 28, 2024 · c2ccba4 · c2ccba4
1 parent 1fe8d41
commit c2ccba4
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/config/DFIR-ORC_config.xml b/config/DFIR-ORC_config.xml
@@ -505,6 +505,7 @@
 
         <command keyword="GetLegacyBootCode_offline">
             <execute name="Orc.exe" run="self:#GetSectors" />
+            <argument>/disk=%OfflineLocation%</argument>
             <output  name="BootCode.7z" source="File" argument="/LegacyBootCode /SlackSpace /Out={FileName}" />
             <output  name="BootCode.log" source="StdOutErr" />
         </command>
@@ -513,6 +514,7 @@
 
         <command keyword="GetUefiFull_offline">
             <execute name="Orc.exe" run="self:#GetSectors" />
+            <argument>/disk=%OfflineLocation%</argument>
             <output  name="UefiFull.7z" source="File" argument="/UefiFull /Out={FileName}" />
             <output  name="UefiFull.log" source="StdOutErr" />
         </command>