Packages and Binaries:
The forensic imager contained in this package, guymager, was designed to support different image file formats, to be most user-friendly and to run really fast. It has a high speed multi-threaded engine using parallel compression for best performance on multi-processor and hyper-threading machines.
How to install:
sudo apt install guymager
- libparted0 | libparted
- libqt5gui5 | libqt5gui5-gles
A forensic acquisition program
root@kali:~# man guymager
guymager(1) General Commands Manual guymager(1)
0.8.13-1" "guymager manual pages"
guymager - a forensic acquisition program
guymager [log=log_file] [cfg=configuration_file] [options]
Guymager is a Qt-based forensic imager. It is capable of producing im-
age files in EWF, AFF and dd format. Its main strenghs are the easy
user interface, the high imaging speed and the extended acquisition
The internal structure is based on separate threads for reading, hash
calculation (MD5 and SHA256), writing and includes a parallelised com-
pression engine, thus making full usage of multi-processor and hy-
Guymager should be run with root privileges, as other users do not have
access to physical devices normally.
By default, guymager uses /var/log/guymager.log as its log file.
This option allows for specifying a different file.
The default configuration file is /etc/guymager/guymager.cfg.
This option allows for specifying a different file. Guymager
creates a template configuration file when the option -cfg=tem-
plate.cfg is given.
All other configuration options may be specified on the command line
and/or in the configuration file. See /etc/guymager/guymager.cfg for a
description of all possible options. In case an option is specified in
the configuration file and on the command line, the command line domi-
Guymager normally returns an exit code of 0. Exit code 1 means that
Guymager terminated because the AutoExit function became active. All
other exit codes are related to internal Guymager or Qt errors.
Write all log entries to ./my.log:
Create a template configuration file
Read the configuration from my.cfg and use 4 threads for parallelised
guymager cfg=my.cfg CompressionThreads=4
See /etc/guymager/guymager.cfg for details about option Compression-
Threads and all other options as well.
Guy Voncken (develop (at) faert.net)
version 0.8.13-2 2022-12-31 guymager(1)
Updated on: 2023-Aug-10