- Home
- Digital Forensics Software
- Guymager
Guymager
What it is
Guymager is a free Linux forensic imager for acquiring storage devices and removable media. It creates flat dd, EWF (E01), and AFF images, and supports disk cloning. Its multithreaded, pipelined design and multithreaded compression are intended to use multiple processors during imaging. The author says it calculates a hash of source data packed into an EWF image, with optional hash calculation for generated image files. To reduce the chance of selecting the wrong disk, users can configure local hard disk serial numbers so those disks are marked and blocked from acquisition. Acquisition and cloning dialogs can be tailored with added or removed fields and static or dynamic defaults. The interface is available in multiple languages. Version 0.8.x scans attached devices using libudev rather than udisks. The maker describes installation on Debian, Ubuntu, Debian-based systems, and through RPM packages. Guymager is included in several forensic live CDs and virtual machines. The author accepts problem reports by email and asks users to include the log file.
For and against
For
- Creates dd, EWF/E01, and AFF images
- Supports disk cloning
- Can optionally hash generated image files
- Serial-number rules can block selected disks
- Available free for Linux
Against
- Linux only
- No command-line version was stated in a 2018 discussion
The verdict
Guymager provides disk imaging and cloning with configurable dialogs and hash options. Its listed platform is Linux, and the author accepts problem reports by email.
Who it suits
Guymager suits Linux users who need to acquire or clone storage devices and removable media for forensic work. It may also fit users who want configurable acquisition dialogs and image verification options.
Plans and prices
Guymager
Linux forensic imager · open source
Read 8 Oct 2026 · guymager.sourceforge.io
On the record
- Configuration
- Users can adapt acquisition and cloning dialogs by adding or removing fields and setting static or dynamic default values.guymager.sourceforge.io · read 8 Oct 2026
- Device detection
- Version 0.8.x uses libudev to scan attached devices instead of relying on udisks.sourceforge.net · read 8 Oct 2026
- Device protection
- Local hard disks identified by configured serial numbers are marked and cannot be acquired, to help prevent selecting the wrong disk.guymager.sourceforge.io · read 8 Oct 2026
- Image formats
- It generates flat (dd), EWF (E01), and AFF images, and supports disk cloning.guymager.sourceforge.io · read 8 Oct 2026
- Installation
- The maker describes installation on Debian, Ubuntu, Debian-based Linux systems, and via RPM packages.guymager.sourceforge.io · read 8 Oct 2026
- Integrations
- The maker lists Guymager as included on several forensic live CDs and virtual machines, including CAINE, TSURUGI, BACKBOX, Kali, GRML, ForLEx, SANS SIFT, and BitCurator.guymager.sourceforge.io · read 8 Oct 2026
- Interface
- The user interface is available in different languages.guymager.sourceforge.io · read 8 Oct 2026
- Limit
- The author stated in a 2018 wiki discussion that Guymager had no command-line version at that time.sourceforge.net · read 8 Oct 2026
- Performance
- Its multithreaded, pipelined design and multithreaded data compression are intended to make imaging fast and use multiple processors.guymager.sourceforge.io · read 8 Oct 2026
- Purpose
- Guymager is a forensic imager for acquiring media.guymager.sourceforge.io · read 8 Oct 2026
- Support
- The author accepts problem reports by email and asks users to attach the Guymager log file.guymager.sourceforge.io · read 8 Oct 2026
- Verification
- The author says Guymager calculates a hash of the source data packed into an EWF image and can optionally calculate hashes for generated image files.sourceforge.net · read 8 Oct 2026
