OrcCommand: WolfExecution: print archive file size once completed

DFIR-ORC · Nov 20, 2020 · 873a38f · 873a38f
1 parent 132f49f
commit 873a38f
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 2 deletions.
diff --git a/src/OrcCommand/UtilitiesMain.h b/src/OrcCommand/UtilitiesMain.h
@@ -172,7 +172,7 @@ class ORCLIB_API UtilitiesMain
                                 Log::Info(L"Archive: Output '{}' added", item->Keyword());
                                 break;
                             case ArchiveNotification::ArchiveComplete:
-                                Log::Info(L"Archive: '{}' is complete", item->Keyword());
+                                Log::Info(L"Archive: '{}' is complete ({})", item->Keyword(), item->FileSize());
                                 break;
                         }
                     }

diff --git a/src/OrcCommand/WolfExecution_Execute.cpp b/src/OrcCommand/WolfExecution_Execute.cpp
@@ -201,7 +201,11 @@ HRESULT WolfExecution::CreateArchiveAgent()
                     m_journal.Print(archive->CommandSet(), operation, L"Add stream: {}", archive->Keyword());
                     break;
                 case ArchiveNotification::ArchiveComplete:
-                    m_journal.Print(archive->CommandSet(), operation, L"Completed: {}", archive->Keyword());
+                    m_journal.Print(
+                        archive->CommandSet(),
+                        operation, L"Completed: {} ({})",
+                        archive->Keyword(),
+                        archive->FileSize());
                     break;
             }
         });

diff --git a/src/OrcLib/ArchiveAgent.cpp b/src/OrcLib/ArchiveAgent.cpp
@@ -444,6 +444,10 @@ void ArchiveAgent::run()
                 {
                     notification = ArchiveNotification::MakeSuccessNotification(
                         request, ArchiveNotification::ArchiveComplete, m_cabName);
+                    if (notification)
+                    {
+                        notification->SetFileSize(m_cabName);
+                    }
                 }
 
                 if (notification)