Common Options & Properties

Supported Versions

File system related tools are entirely implemented in native C++, compiled with Visual Studio 2017 Update 9 and do not require any installation prior to execution on the currently supported versions of Windows.


Getting help can be done using /help or /?, for configured and unconfigured binaries.

DFIR-Orc.exe /help
DFIR-Orc_x64.exe NTFSUtil /?

For any tool embedded by default, the same options apply. For example, both of the following commands display the help menu for NTFSUtil:

DFIR-Orc_x64.exe NTFSUtil /help
DFIR-Orc.exe NTFSUtil /?