guymager is a graphical forensic imaging application for acquiring copies of storage devices while preserving the evidence needed for subsequent analysis. It provides a dedicated interface for selecting source media, configuring acquisition options and monitoring imaging operations. The software is designed for forensic investigators who need reliable disk acquisition without manually constructing complex command-line operations.
The application uses a multithreaded, pipelined architecture to read source data, calculate hashes, compress images and write output concurrently. It supports several established forensic image formats and can clone storage devices directly. Acquisition metadata can be recorded alongside the image, including details about the source media and examination process. guymager also provides verification options that help investigators distinguish errors in the completed image from inconsistent data returned by failing source media.
This is free and open source software.
Key Features
- Graphical interface for forensic media acquisition and disk cloning.
- Support for raw (dd), Expert Witness (E01) and AFF image formats.
- Multithreaded acquisition engine with pipelined data processing.
- Parallel compression to improve acquisition performance.
- Calculate MD5, SHA-1 and SHA-256 hashes during imaging.
- Verify completed images against acquisition hashes.
- Optional source verification by rereading the original media.
- Record detailed acquisition metadata in an accompanying information file.
- Display connected storage devices and rescan for newly attached media.
- Identify and protect configured local system disks against accidental acquisition.
- Customisable acquisition and cloning dialogs.
- Configure default evidence information and acquisition settings.
- Display acquisition progress and source device information.
- User interface available in multiple languages.
Website: guymager.sourceforge.io
Support:
Developer: Guy Voncken
License: GNU General Public License v2.0
guymager is written in C++. Learn C++ with our recommended free books and free tutorials.
Related Software
| Digital Forensics Tools | |
|---|---|
| GRR Rapid Response | Remote live forensics for incident response |
| Radare2 | Portable reversing framework |
| The Sleuth Kit | Collection of tools for forensic analysis |
| MemProcFS | View physical memory as files in a virtual file system |
| Autopsy Forensic Browser | Graphical interface to SleuthKit |
| iaito | Official graphical interface for radare2 |
| Chainsaw | Fast forensic triage and threat hunting tool for Windows artefacts |
| Velociraptor | Endpoint visibility and collection tool |
| Timesketch | Collaborative forensic timeline analysis |
| Plaso | Python-based digital forensics framework |
| Volatility | Advanced memory forensics framework |
| UAC | Collect forensic artefacts from Linux and other Unix-like systems |
| IPED | Process, index and analyse large collections of digital evidence |
| guymager | Forensic imaging tool based on Qt |
| Dissect | Access and query evidence across disk images and file systems |
| dcfldd | Enhanced version of dd for forensics and security |
| rdd | Forensic copy program |
| Jomon | Network forensics and passive sniffer |
| Mozilla InvestiGator | Real-time digital forensics and investigation platform |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.