guymager - Imager for forensic media acquisition

Distribution: Fedora 25
Repository: CERT Forensics Tools x86_64
Package name: guymager
Package version: 0.8.7
Package release: 2.fc25
Package architecture: x86_64
Package type: rpm
Installed size: 1.04 MB
Download size: 350.22 KB
Official Mirror:
guymager is an imager for forensic media acquisition. Its main features are: * Easy user interface in different languages * Runs under Linux * Multi-threaded design, multi-threaded data compression * Makes full usage of multi-processor machines * Generates flat (dd) and EWF (E01) images



  • guymager = 0.8.7-2.fc25
  • guymager(x86-64) = 0.8.7-2.fc25


    Install Howto

    1. Download cert-forensics-tools-release-25 rpm:
    2. Install cert-forensics-tools-release-25 rpm:
      # rpm -Uvh cert-forensics-tools-release*rpm
    3. Install guymager rpm package:
      # dnf --enablerepo=forensics install guymager


    • /etc/guymager/guymager.cfg
    • /usr/bin/guymager
    • /usr/share/man/man1/guymager.1.gz


    2018-01-16 - Lawrence R. Rogers <> 0.8.7-2 * Release 0.8.7-2 Rebuilt with libguytools-2.0.5.

    2017-09-22 - Lawrence R. Rogers <> 0.8.7-1 * Release 0.8.7-1 guymager-beta (0.8.7-1) unstable; urgency=low * Typing errors corrected guymager-beta (0.8.6-1) unstable; urgency=low * Upon disconnection of device, do not pause verification if it is done on the image only (pausing still for source verifications). * New cfg parameter AdditionalStateInfoName * System signal HUP triggers device rescanning * Special tokens %UserField% and %AddStateInfo% added guymager-beta (0.8.5-1) unstable; urgency=low * New cfg parameters BadSectorLogThreshold and BadSectorLogModulo.

    2017-02-02 - Lawrence R. Rogers <> 0.8.4-1 * Release 0.8.4-1 guymager-beta (0.8.4-1) unstable; urgency=low * Removed bug that occurred if remaining time was longer than 99 hours * Adapted to gcc7 guymager-beta (0.8.3-1) unstable; urgency=low * Corrected bug where Guymager not always recognised if duplicate image or info file was the same as first one. * In the duplicate acquisition dialog mark the device selected in the first acquisition dialog and make it unselectable. * New features in acquisition dialog: Allow relative paths in filenames, allow direct editing of directory fields. See new configuration parameters DirectoryFieldEditing, AllowPathInFilename and ConfirmDirectoryCreation. * Forbid overwriting image / info files of other acquisitions (up until now, only an warning was shown that could have been ignored by the user). guymager-beta (0.8.2-1) unstable; urgency=low * Support for SHA1 checksum in EWF images (for AEWF and LIBEWF) * Corrected bug where directory button in dlgacquire would be drawn half underneath entry field for certain configuration settings. * Corrected bug where %SizeHumanNoSep% behaved the same as %SizeHuman%

    2015-03-03 - Lawrence R. Rogers <> 0.8.1-1 * Release 0.8.1-1 * New DeviceScanMethod libudev * Adapted to Qt 5 API * For computers with non standard mouse: Double click open context menu * New configuration parameter AvoidCifsProblems * Show version number in main window title bar * Debug CIFS flcose problem * Added EWFX support from libewf

    2015-03-03 - Lawrence R. Rogers <> 0.7.4-2 * Release 0.7.4-2 Rebuilt with libguytools-2.0.3

    2014-10-30 - Lawrence R. Rogers <> 0.7.4-1 * Release 0.7.4-1 * Added output for hostname, domainname and system to info file * New cfg param InfoFieldsForDd * Corrected bug: DisconnectTimeout only must be active if LimitJobs is active * libewf version check changed, all versions >= 20130416 are accepted * New cfg parameter InfoFieldsForDd

    2014-05-19 - Lawrence R. Rogers <> 0.7.3-2 * Release 0.7.3-2 Use latest version of libewf Installed workaround where \ at the end of a line in the config file caused errors

    2014-01-17 - Lawrence R. Rogers <> 0.7.3-1 * Release 0.7.3-1

    2013-03-15 - Lawrence R. Rogers <> 0.7.1-1 * Release 0.7.1-1 * Duplicate image creation * New RunStats module * New job queue mechanism * New userfield * New configuration table for main Guymager table * New font configuration * New cfg table HiddenDevices * New configuration parameter CommandAcquisitionEnd * Writing hidden area info into info file * Gray out rescan button when scan is running * In order to avoid the "contagious error", DirectIO is switched on in fallback mode. * Removed race condition where write thread would write hash into image before it has been calculated by hash thread. * SHA-1 support added

    2012-12-27 - Lawrence R. Rogers <> 0.6.13-1 * Release 0.6.13-1 * Package dependency to udisks added (for recent Ubuntu) * libparted search extended to subdirs * Added cfg parameter ForceCommandGetSerialNumber