MozDef - RAR Archive Creation Guide (Maximum Compression)
π― Objective
Create a RAR archive with maximum compression for the complete MozDef project including Docker images.
π¦ Archive Contents
- Docker Images: All 17 MozDef images (~9-10 GB uncompressed)
- Source Code: Complete MozDef source (~75 MB)
- Documentation: All markdown documentation files
Estimated Archive Size: ~5-8 GB (with maximum RAR compression)
π Quick Start
Method 1: RAR Archive (Best Compression)
cd /root/MozDef
./archive_mozdef_rar.sh
Script: /root/MozDef/archive_mozdef_rar.sh
RAR Compression Settings:
-m5= Maximum compression-rr10%= 10% recovery record (data recovery)-s= Solid archive (better compression)-ep1= Exclude base directory
Method 2: 7zip Archive (Alternative)
If RAR is not available:
cd /root/MozDef
./archive_mozdef_7z.sh
7zip Compression Settings:
-mx=9= Maximum compression-m0=lzma2= LZMA2 compression method-mmt=on= Multi-threading
Method 3: Tar.gz (Fallback)
cd /root/MozDef
./archive_mozdef.sh
π Installation Requirements
Install RAR (Debian/Ubuntu)
apt-get update
apt-get install -y rar unrar
Install RAR (RHEL/CentOS)
yum install -y rar unrar
# Or download from: https://www.rarlab.com/download.htm
Install 7zip (Alternative)
# Debian/Ubuntu
apt-get install -y p7zip-full
# RHEL/CentOS
yum install -y p7zip-full
π§ Manual RAR Archive Creation
Step 1: Prepare Archive Directory
ARCHIVE_DIR="$HOME/mozdef-archive-$(date +%Y%m%d)"
mkdir -p "$ARCHIVE_DIR"/{docker-images,source-code,documentation}
Step 2: Save Docker Images
docker save $(docker images mozdef/* --format "{{.Repository}}:{{.Tag}}") \
-o "$ARCHIVE_DIR/docker-images/mozdef-all-images.tar"
Step 3: Archive Source Code
tar -czf "$ARCHIVE_DIR/source-code/MozDef-source.tar.gz" \
-C /root MozDef \
--exclude='MozDef/.git' \
--exclude='MozDef/node_modules' \
--exclude='MozDef/.meteor/local'
Step 4: Copy Documentation
cp /root/MozDef/*.md "$ARCHIVE_DIR/documentation/"
Step 5: Create RAR Archive
cd "$(dirname "$ARCHIVE_DIR")"
rar a -m5 -rr10% -s -ep1 "mozdef-complete-$(date +%Y%m%d).rar" "$(basename "$ARCHIVE_DIR")"
RAR Options Explained:
a= Add files to archive-m5= Maximum compression level (0-5, 5 = best)-rr10%= Add 10% recovery record for data recovery-s= Create solid archive (better compression)-ep1= Exclude base directory from paths-v2g= Split into 2GB volumes (optional, for large files)
π Compression Comparison
| Method | Compression | Estimated Size | Recovery |
|---|---|---|---|
| RAR (-m5) | Maximum | ~5-8 GB | β 10% recovery |
| 7zip (-mx=9) | Maximum | ~5-8 GB | β No recovery |
| tar.gz (-9) | Best | ~8-12 GB | β No recovery |
Recommendation: Use RAR for best compression + recovery record.
π₯ Extracting RAR Archive
Extract Complete Archive
unrar x mozdef-complete-YYYYMMDD.rar
Extract to Specific Directory
unrar x mozdef-complete-YYYYMMDD.rar /destination/path/
List Archive Contents
unrar l mozdef-complete-YYYYMMDD.rar
Test Archive Integrity
unrar t mozdef-complete-YYYYMMDD.rar
π Restoring from RAR Archive
Step 1: Extract RAR Archive
unrar x mozdef-complete-YYYYMMDD.rar
cd mozdef-archive-YYYYMMDD/
Step 2: Load Docker Images
docker load -i docker-images/mozdef-all-images.tar
docker images mozdef/* # Verify (should show 17 images)
Step 3: Extract Source Code
tar -xzf source-code/MozDef-source.tar.gz -C /root/
Step 4: Start Services
cd /root/MozDef
docker-compose -f docker/compose/docker-compose.yml -p mozdef up -d
π RAR Archive Features
Advantages
- β Best compression (typically 20-30% better than tar.gz)
- β Recovery record (can recover damaged archives)
- β Solid archive (better compression for multiple files)
- β Volume splitting (split large files automatically)
- β
Password protection (optional: add
-pPASSWORD)
Recovery Record
The -rr10% option adds 10% recovery data, allowing you to:
- Recover damaged archives
- Repair corrupted files
- Extract data even if archive is partially damaged
Usage:
# Repair damaged archive
rar r mozdef-complete-YYYYMMDD.rar
# Extract with recovery
unrar x -kb mozdef-complete-YYYYMMDD.rar
π Password Protection (Optional)
Create Password-Protected Archive
rar a -m5 -rr10% -s -ep1 -pYOUR_PASSWORD "mozdef-complete-$(date +%Y%m%d).rar" "$(basename "$ARCHIVE_DIR")"
Extract Password-Protected Archive
unrar x -pYOUR_PASSWORD mozdef-complete-YYYYMMDD.rar
π Archive Size Estimation
Before Compression
- Docker images: ~9-10 GB
- Source code: ~75 MB
- Documentation: ~1-5 MB
- Total: ~9-10 GB
After RAR Compression (-m5)
- Estimated: ~5-8 GB (40-50% compression ratio)
After 7zip Compression (-mx=9)
- Estimated: ~5-8 GB (similar to RAR)
After tar.gz Compression (-9)
- Estimated: ~8-12 GB (20-30% compression ratio)
β‘ Performance Tips
For Faster Compression
# Use lower compression (faster)
rar a -m3 -s "archive.rar" directory/
# Use multi-threading (7zip)
7z a -mx=5 -mmt=on "archive.7z" directory/
For Maximum Compression (Slower)
# RAR maximum
rar a -m5 -s "archive.rar" directory/
# 7zip maximum
7z a -mx=9 -m0=lzma2 "archive.7z" directory/
β Verification
Check Archive Integrity
# RAR
unrar t mozdef-complete-YYYYMMDD.rar
# 7zip
7z t mozdef-complete-YYYYMMDD.7z
List Archive Contents
# RAR
unrar l mozdef-complete-YYYYMMDD.rar
# 7zip
7z l mozdef-complete-YYYYMMDD.7z
Check Archive Size
ls -lh mozdef-complete-*.rar
du -sh mozdef-complete-*.rar
π Script Usage
RAR Archive Script
cd /root/MozDef
./archive_mozdef_rar.sh
Output:
- Creates:
~/mozdef-complete-YYYYMMDD.rar - Size: ~5-8 GB (compressed)
- Includes: Docker images, source code, documentation
7zip Archive Script (Alternative)
cd /root/MozDef
./archive_mozdef_7z.sh
Output:
- Creates:
~/mozdef-complete-YYYYMMDD.7z - Size: ~5-8 GB (compressed)
π Transferring RAR Archive
USB Drive
cp mozdef-complete-*.rar /mnt/usb/
Network Transfer
# SCP
scp mozdef-complete-*.rar user@target:/path/
# rsync (with progress)
rsync -avz --progress mozdef-complete-*.rar user@target:/path/
Split Large Files (if needed)
# RAR automatically handles volumes with -v option
# Or manually split:
split -b 2G mozdef-complete.rar mozdef-complete.rar.part
# Reassemble:
cat mozdef-complete.rar.part* > mozdef-complete.rar
π Summary
Best Method: RAR with maximum compression
- Script:
./archive_mozdef_rar.sh - Compression: Maximum (-m5)
- Recovery: 10% recovery record
- Estimated Size: ~5-8 GB
Alternative: 7zip if RAR unavailable
- Script:
./archive_mozdef_7z.sh - Compression: Maximum (-mx=9)
- Estimated Size: ~5-8 GB
Fallback: tar.gz
- Script:
./archive_mozdef.sh - Compression: Best (-9)
- Estimated Size: ~8-12 GB
Last Updated: $(date)