From c2ccba4dd731b813cf782e2e4b65a5b14ffa6170 Mon Sep 17 00:00:00 2001
From: Sebastien Chapiron <sebastien.chapiron@ssi.gouv.fr>
Date: Thu, 28 Mar 2024 11:12:09 +0100
Subject: [PATCH] Fix #11: GetSectors dumps the host's sectors instead of those
 of the target offline disk image.

---
 config/DFIR-ORC_config.xml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/DFIR-ORC_config.xml b/config/DFIR-ORC_config.xml
index 3ae7faa..c59f716 100644
--- a/config/DFIR-ORC_config.xml
+++ b/config/DFIR-ORC_config.xml
@@ -505,6 +505,7 @@
 
         <command keyword="GetLegacyBootCode_offline">
             <execute name="Orc.exe" run="self:#GetSectors" />
+            <argument>/disk=%OfflineLocation%</argument>
             <output  name="BootCode.7z" source="File" argument="/LegacyBootCode /SlackSpace /Out={FileName}" />
             <output  name="BootCode.log" source="StdOutErr" />
         </command>
@@ -513,6 +514,7 @@
 
         <command keyword="GetUefiFull_offline">
             <execute name="Orc.exe" run="self:#GetSectors" />
+            <argument>/disk=%OfflineLocation%</argument>
             <output  name="UefiFull.7z" source="File" argument="/UefiFull /Out={FileName}" />
             <output  name="UefiFull.log" source="StdOutErr" />
         </command>