Mozdef / RAR_ARCHIVE_GUIDE.md
ineso22's picture
Upload folder using huggingface_hub
7c89ed7 verified

MozDef - RAR Archive Creation Guide (Maximum Compression)

🎯 Objective

Create a RAR archive with maximum compression for the complete MozDef project including Docker images.


πŸ“¦ Archive Contents

  • Docker Images: All 17 MozDef images (~9-10 GB uncompressed)
  • Source Code: Complete MozDef source (~75 MB)
  • Documentation: All markdown documentation files

Estimated Archive Size: ~5-8 GB (with maximum RAR compression)


πŸš€ Quick Start

Method 1: RAR Archive (Best Compression)

cd /root/MozDef
./archive_mozdef_rar.sh

Script: /root/MozDef/archive_mozdef_rar.sh

RAR Compression Settings:

  • -m5 = Maximum compression
  • -rr10% = 10% recovery record (data recovery)
  • -s = Solid archive (better compression)
  • -ep1 = Exclude base directory

Method 2: 7zip Archive (Alternative)

If RAR is not available:

cd /root/MozDef
./archive_mozdef_7z.sh

7zip Compression Settings:

  • -mx=9 = Maximum compression
  • -m0=lzma2 = LZMA2 compression method
  • -mmt=on = Multi-threading

Method 3: Tar.gz (Fallback)

cd /root/MozDef
./archive_mozdef.sh

πŸ“‹ Installation Requirements

Install RAR (Debian/Ubuntu)

apt-get update
apt-get install -y rar unrar

Install RAR (RHEL/CentOS)

yum install -y rar unrar
# Or download from: https://www.rarlab.com/download.htm

Install 7zip (Alternative)

# Debian/Ubuntu
apt-get install -y p7zip-full

# RHEL/CentOS
yum install -y p7zip-full

πŸ”§ Manual RAR Archive Creation

Step 1: Prepare Archive Directory

ARCHIVE_DIR="$HOME/mozdef-archive-$(date +%Y%m%d)"
mkdir -p "$ARCHIVE_DIR"/{docker-images,source-code,documentation}

Step 2: Save Docker Images

docker save $(docker images mozdef/* --format "{{.Repository}}:{{.Tag}}") \
  -o "$ARCHIVE_DIR/docker-images/mozdef-all-images.tar"

Step 3: Archive Source Code

tar -czf "$ARCHIVE_DIR/source-code/MozDef-source.tar.gz" \
  -C /root MozDef \
  --exclude='MozDef/.git' \
  --exclude='MozDef/node_modules' \
  --exclude='MozDef/.meteor/local'

Step 4: Copy Documentation

cp /root/MozDef/*.md "$ARCHIVE_DIR/documentation/"

Step 5: Create RAR Archive

cd "$(dirname "$ARCHIVE_DIR")"
rar a -m5 -rr10% -s -ep1 "mozdef-complete-$(date +%Y%m%d).rar" "$(basename "$ARCHIVE_DIR")"

RAR Options Explained:

  • a = Add files to archive
  • -m5 = Maximum compression level (0-5, 5 = best)
  • -rr10% = Add 10% recovery record for data recovery
  • -s = Create solid archive (better compression)
  • -ep1 = Exclude base directory from paths
  • -v2g = Split into 2GB volumes (optional, for large files)

πŸ“Š Compression Comparison

Method Compression Estimated Size Recovery
RAR (-m5) Maximum ~5-8 GB βœ… 10% recovery
7zip (-mx=9) Maximum ~5-8 GB ❌ No recovery
tar.gz (-9) Best ~8-12 GB ❌ No recovery

Recommendation: Use RAR for best compression + recovery record.


πŸ“₯ Extracting RAR Archive

Extract Complete Archive

unrar x mozdef-complete-YYYYMMDD.rar

Extract to Specific Directory

unrar x mozdef-complete-YYYYMMDD.rar /destination/path/

List Archive Contents

unrar l mozdef-complete-YYYYMMDD.rar

Test Archive Integrity

unrar t mozdef-complete-YYYYMMDD.rar

πŸ”„ Restoring from RAR Archive

Step 1: Extract RAR Archive

unrar x mozdef-complete-YYYYMMDD.rar
cd mozdef-archive-YYYYMMDD/

Step 2: Load Docker Images

docker load -i docker-images/mozdef-all-images.tar
docker images mozdef/*  # Verify (should show 17 images)

Step 3: Extract Source Code

tar -xzf source-code/MozDef-source.tar.gz -C /root/

Step 4: Start Services

cd /root/MozDef
docker-compose -f docker/compose/docker-compose.yml -p mozdef up -d

πŸ“‹ RAR Archive Features

Advantages

  • βœ… Best compression (typically 20-30% better than tar.gz)
  • βœ… Recovery record (can recover damaged archives)
  • βœ… Solid archive (better compression for multiple files)
  • βœ… Volume splitting (split large files automatically)
  • βœ… Password protection (optional: add -pPASSWORD)

Recovery Record

The -rr10% option adds 10% recovery data, allowing you to:

  • Recover damaged archives
  • Repair corrupted files
  • Extract data even if archive is partially damaged

Usage:

# Repair damaged archive
rar r mozdef-complete-YYYYMMDD.rar

# Extract with recovery
unrar x -kb mozdef-complete-YYYYMMDD.rar

πŸ”’ Password Protection (Optional)

Create Password-Protected Archive

rar a -m5 -rr10% -s -ep1 -pYOUR_PASSWORD "mozdef-complete-$(date +%Y%m%d).rar" "$(basename "$ARCHIVE_DIR")"

Extract Password-Protected Archive

unrar x -pYOUR_PASSWORD mozdef-complete-YYYYMMDD.rar

πŸ“Š Archive Size Estimation

Before Compression

  • Docker images: ~9-10 GB
  • Source code: ~75 MB
  • Documentation: ~1-5 MB
  • Total: ~9-10 GB

After RAR Compression (-m5)

  • Estimated: ~5-8 GB (40-50% compression ratio)

After 7zip Compression (-mx=9)

  • Estimated: ~5-8 GB (similar to RAR)

After tar.gz Compression (-9)

  • Estimated: ~8-12 GB (20-30% compression ratio)

⚑ Performance Tips

For Faster Compression

# Use lower compression (faster)
rar a -m3 -s "archive.rar" directory/

# Use multi-threading (7zip)
7z a -mx=5 -mmt=on "archive.7z" directory/

For Maximum Compression (Slower)

# RAR maximum
rar a -m5 -s "archive.rar" directory/

# 7zip maximum
7z a -mx=9 -m0=lzma2 "archive.7z" directory/

βœ… Verification

Check Archive Integrity

# RAR
unrar t mozdef-complete-YYYYMMDD.rar

# 7zip
7z t mozdef-complete-YYYYMMDD.7z

List Archive Contents

# RAR
unrar l mozdef-complete-YYYYMMDD.rar

# 7zip
7z l mozdef-complete-YYYYMMDD.7z

Check Archive Size

ls -lh mozdef-complete-*.rar
du -sh mozdef-complete-*.rar

πŸ“ Script Usage

RAR Archive Script

cd /root/MozDef
./archive_mozdef_rar.sh

Output:

  • Creates: ~/mozdef-complete-YYYYMMDD.rar
  • Size: ~5-8 GB (compressed)
  • Includes: Docker images, source code, documentation

7zip Archive Script (Alternative)

cd /root/MozDef
./archive_mozdef_7z.sh

Output:

  • Creates: ~/mozdef-complete-YYYYMMDD.7z
  • Size: ~5-8 GB (compressed)

πŸš€ Transferring RAR Archive

USB Drive

cp mozdef-complete-*.rar /mnt/usb/

Network Transfer

# SCP
scp mozdef-complete-*.rar user@target:/path/

# rsync (with progress)
rsync -avz --progress mozdef-complete-*.rar user@target:/path/

Split Large Files (if needed)

# RAR automatically handles volumes with -v option
# Or manually split:
split -b 2G mozdef-complete.rar mozdef-complete.rar.part

# Reassemble:
cat mozdef-complete.rar.part* > mozdef-complete.rar

πŸ“‹ Summary

Best Method: RAR with maximum compression

  • Script: ./archive_mozdef_rar.sh
  • Compression: Maximum (-m5)
  • Recovery: 10% recovery record
  • Estimated Size: ~5-8 GB

Alternative: 7zip if RAR unavailable

  • Script: ./archive_mozdef_7z.sh
  • Compression: Maximum (-mx=9)
  • Estimated Size: ~5-8 GB

Fallback: tar.gz

  • Script: ./archive_mozdef.sh
  • Compression: Best (-9)
  • Estimated Size: ~8-12 GB

Last Updated: $(date)