Freedom251 › Digital Forensics Software
Guymager
What Guymager is
Guymager is a free, open-source forensic imager for acquiring storage devices and removable media on Linux. It can create flat dd, EWF (E01), and AFF images, and supports disk cloning. Its multithreaded, pipelined architecture and multithreaded compression are designed to use multiple processors during imaging. For verification, the author says Guymager calculates a hash of source data packed into an EWF image; it can also optionally calculate hashes for generated image files.
To reduce the risk of acquiring the wrong disk, configured serial numbers let users mark local hard disks that Guymager must not acquire. Acquisition and cloning dialogs can be tailored by adding or removing fields and setting static or dynamic defaults. The interface is available in different languages. Version 0.8.x scans attached devices with libudev rather than relying on udisks.
The maker describes installation on Debian, Ubuntu, other Debian-based Linux systems, and through RPM packages. Guymager is also included with several forensic live CDs and virtual machines, including CAINE, TSURUGI, BACKBOX, Kali, GRML, ForLEx, SANS SIFT, and BitCurator. The author accepts problem reports by email and asks users to include the Guymager log file.
Who it suits
Guymager suits Linux users who need to acquire or clone storage devices and removable media into dd, EWF/E01, or AFF images. Its configurable dialogs, optional image-file hashes, and serial-number protections may be useful in forensic imaging workflows.
What it does well
- Creates dd, EWF/E01, and AFF images.
- Supports disk cloning.
- Can calculate hashes for generated image files.
- Configured local disk serial numbers can prevent acquisition.
- Acquisition and cloning dialogs are customizable.
- Interface is available in different languages.
What to know first
- Available for Linux only.
- The author stated in a 2018 wiki discussion that there was no command-line version then.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Guymager | Linux forensic imager · open source | Free |
As guymager.sourceforge.io lists them, read 8 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Guymager website.
- Choose an installation route described by the maker: Debian, Ubuntu, another Debian-based Linux system, or an RPM package.
- Install Guymager on a Linux system.
- Configure acquisition or cloning dialog fields and defaults as needed.
- Set serial numbers for local hard disks that should be marked and excluded from acquisition.
Verdict
Choose Guymager if you need a free Linux tool for acquiring or cloning media into dd, EWF/E01, or AFF images. Its configurable dialogs and disk protections support careful acquisition workflows. Look elsewhere if you need a command-line version, based on the author's 2018 statement.
Questions
How much does Guymager cost?
The listed Guymager plan is free.
Which image formats can Guymager create?
It creates flat dd, EWF (E01), and AFF images. It also supports disk cloning.
Which operating systems does it support?
Guymager is listed for Linux. The maker describes installation on Debian, Ubuntu, Debian-based Linux systems, and through RPM packages.
Is Guymager open source?
Yes. The listed plan describes Guymager as open source.
Does Guymager have a command-line version?
The author stated in a 2018 wiki discussion that Guymager had no command-line version at that time.
How can users contact the author for support?
The author accepts problem reports by email and asks users to attach the Guymager log file.
Facts from Guymager's own pages
- Configuration
- Users can adapt acquisition and cloning dialogs by adding or removing fields and setting static or dynamic default values. · guymager.sourceforge.io, 8 Oct 2026
- Device detection
- Version 0.8.x uses libudev to scan attached devices instead of relying on udisks. · sourceforge.net, 8 Oct 2026
- Device protection
- Local hard disks identified by configured serial numbers are marked and cannot be acquired, to help prevent selecting the wrong disk. · guymager.sourceforge.io, 8 Oct 2026
- Image formats
- It generates flat (dd), EWF (E01), and AFF images, and supports disk cloning. · guymager.sourceforge.io, 8 Oct 2026
- Installation
- The maker describes installation on Debian, Ubuntu, Debian-based Linux systems, and via RPM packages. · guymager.sourceforge.io, 8 Oct 2026
- Integrations
- The maker lists Guymager as included on several forensic live CDs and virtual machines, including CAINE, TSURUGI, BACKBOX, Kali, GRML, ForLEx, SANS SIFT, and BitCurator. · guymager.sourceforge.io, 8 Oct 2026
- Interface
- The user interface is available in different languages. · guymager.sourceforge.io, 8 Oct 2026
- Limit
- The author stated in a 2018 wiki discussion that Guymager had no command-line version at that time. · sourceforge.net, 8 Oct 2026
- Performance
- Its multithreaded, pipelined design and multithreaded data compression are intended to make imaging fast and use multiple processors. · guymager.sourceforge.io, 8 Oct 2026
- Purpose
- Guymager is a forensic imager for acquiring media. · guymager.sourceforge.io, 8 Oct 2026
- Support
- The author accepts problem reports by email and asks users to attach the Guymager log file. · guymager.sourceforge.io, 8 Oct 2026
- Verification
- The author says Guymager calculates a hash of the source data packed into an EWF image and can optionally calculate hashes for generated image files. · sourceforge.net, 8 Oct 2026
Where Guymager stands on Freedom251
- Digital Forensics Software#9 of 30