Guymager

Guymager is a free, open-source forensic imaging tool for Linux designed to create exact, write-protected copies of storage devices. It emphasizes reliability and speed, providing a graphical user interface that guides investigators through the acquisition process while minimizing the risk of altering evidence.

Imaging formats and integrity: Guymager supports several image formats, including RAW (dd-like), EnCase EWF, and AFF. During acquisition it computes and records cryptographic hashes (such as MD5, SHA-1, and SHA-256) to verify image integrity, and it can compare results against known hash values. The tool is designed to work with hardware write blockers and can operate in automated or batched modes.

Workflow and operation: The user selects a source device, a destination directory, and an image format, then initiates imaging. Guymager performs a sector-level copy, verifies the image, and logs the operation. It can auto-detect devices, present them in a list, and produce supplementary metadata and reports as needed. The GUI aims to be accessible for non-specialists while preserving forensic best practices.

Development and availability: Guymager is released under the GNU General Public License and is maintained by the open-source forensics community. It is commonly packaged for Linux distributions and can be installed from repositories or compiled from source. Documentation and project information are available on the official website and repository pages.