Guymager homepage Get Guymager at SourceForge.net. Fast, secure and Free Open Source software downloads

Introduction


Guymager is a free forensic imager for media acquisition. Its main features are: The latest version is 0.7.4.

New: Have a look at the Guymager Wiki.

How it looks


Main screen
Explanations:
Acquisition dialog

The above screenshot shows the default acquisition dialog. Another dialog exists for cloning disks. Both can be easily adapted to fit your requirements. You may add or remove fields. You can set their default values statically (text) and dynamically (current date, size of disk, serial number, ...). Have a look at /etc/guymager/guymager.cfg.

Installation

Debian and Ubuntu


Guymager is contained in the standard repositories of several distributions, for example Debian (Squeeze or later) and Ubuntu (10.04 or later). In Ubuntu, the universe repository must be activated.
The installation could be done with a graphical tool like the Ubuntu Software Center or Synaptic. The command line is a safe and easy alternative that always works and is independent from the latest desktop design hype:
   sudo apt-get update
   sudo apt-get install guymager

Using the pinguin APT server


Daniel's pinguin server always contains the latest Guymager release. It is the recommended repository for installing Guymager and keeping it up to date. Use this repository for your Ubuntu, Debian and Debian-based Linux systems.
Follow these steps:
  1. Add the pinguin server and its public key by executing the following commands:
        sudo wget -nH -rP /etc/apt/sources.list.d/ http://deb.pinguin.lu/pinguin.lu.list
        wget -q http://deb.pinguin.lu/debsign_public.key -O- | sudo apt-key add -
    Currently, i386 and amd64 systems are supported, powerpc packages are available upon request.
  2. Execute the following commands:
       sudo apt-get update
       sudo apt-get install guymager-beta
  3. Start the program with
       guymager
Eventhough the package is named guymager-beta, it has been intensively tested and is absolutely stable software. It just hasn't found its way into a distribution yet.

RPM packages


RPM packages are available at the CERT homepage of the Carnegie Mellon University. Many thanks to Larry Rogers for his work!

Manual download and installation of the Debian packages


If you do not like to add the pinguin repository permanently, you can download and install the packages manually:
  1. Browse to apt.pinguin.lu, and choose the directory corresponding to your processor architecture (i386 or amd64).
    Remark: amd64 refers to the architecture, not the processor. So, amd64 is ok for both, the AMD and Intel 64 bit processors.
  2. Download the guymager-beta package.

Installation from the command line:
  1. Open a shell and get root rights
  2. Change to the directory with the files you downloaded.
  3. Use the following commands for the installation:
       sudo apt-get update
       sudo dpkg -i guymager-beta_xxx_i386.deb
       sudo apt-get -f install
    xxx stands for the version number. In case you have a 64 bit system, replace i386 by amd64.
    The 2nd command most probably returns some error messages about missing packages. They are installed by executing the 3rd command.
  4. There are 2 recommended packages you should install as well:
       sudo apt-get install smartmontools hdparm
  5. Start the program with
       guymager

Configuration and log


Guymager works with two configuration files: If you want to try a parameter quickly without editing local.cfg, you may put it on the command line. For example:
   guymager EwfCompression=BEST
The command line precedes both configuration files. There are 2 parameters which only can be set on the command line: Example:
   guymager cfg="/tests/g_special.cfg" log="/mylogs/guymager.log"
The configuration parameters are well documented inside /etc/guymager/guymager.cfg. Just remember not to do any changes there.

If ever there's a problem, have a look at the log file /var/log/guymager.log. Please attach the log file when reporting a problem.

Compiling the source code


For compilation and packaging on Debian based systems refer to the end of this section.

Get the source code:
Let's start with libewf:
  1. Unpack the archive
  2. Compile and install with the standard command trio configure, make, make install. Missing libs and tools have to be installed, refer to the error messages. You probably have to go several times through the "install missing libs / configure" cycle until everything is ok.
  3. After successfull completion of the 3 commands, you not only have the lib required by Guymager, but the libewf tools as well. So, it's easy to check if libewf works fine. Try for instance to run ewfinfo on a EWF (E01) image if you have one available. Try ewfacquire on a memory stick otherwise (see the man pages for details).

Next comes libguytools:
  1. Change to the directory where you did the subversion checkout, go to the subdir tags and further down to the latest version.
  2. To compile libguytools:
       ./create_version_file.sh
       qmake trunk.pro
       make
    Most probably, there will be some tools or libs missing, for instance the Qt developer stuff (libguytools uses qmake). The same procedure as before applies (install/retry/install...). Some of the commands and libs required can be found in different Qt versions and packages. In this case, always choose Qt version 4.
  3. Next, a statically linkable version of the lib is built:
  4.    qmake toolsstatic.pro
       make
  5. There is no installation procedure (except for Debian, see above). After completion of the previous step, the lib is in the subdirectory lib. Copy it to a location that is included in the search path on your system (this could be /usr/local/lib, for instance) or redirect the LD_LIBRARY_PATH environment variable.
  6. Make the headers from the subdirectory "include" available to other applications (for instance by copying to /usr/local/include).

And finally, Guymager:
  1. Change to the directory where you did the subversion checkout, go to the subdir tags and further down to the latest version.
  2. Create the Makefile:
       qmake
  3. Compile:
       make
    If ever you have problems with the library path of libguytools or libewf: Have a look at the end of file guymager.pro and adapt the LIBS statements according to the path where you put the libs. Re-execute qmake when changing guymager.pro.
  4. Create the language files:
       lrelease guymager.pro
  5. Copy the configuration file guymager.cfg to /etc/guymager/

Guymager should now be ready. Start it with:
   ./guymager


Compilation and packaging on a Debian based system is easier. Get the sources of libewf, libguytools and guymager as described above. Then:
  1. Make sure you have the package dpkg-dev installed.
       sudo apt-get install dpkg-dev
  2. Unpack libewf, change into the directory and execute
  3.    dpkg-buildpackage -B -uc -rfakeroot
    Follow the instructions given. Most probably, you will be told to install some additional packages before the compilation and packaging can begin. At the end you will get .deb packages in the directory above.
  4. Do the same for libguytools.
  5. Do the same for Guymager. You will be told to install some of the packages you created in the previous steps (libguytools, libguytools1-dev, libewf and libewf-dev). Install these packages by means of dpkg -i (see above for the usage of dpkg).

Live CDs with Guymager

Guymager is contained on several live CDs and VMs. Some of them are updated more often than others. Take care to chose one with a recent version of Guymager.

Contact


The author of Guymager can be reached by an email to develop at faert point net. If ever you want to report a problem, be sure to attach the Guymager log file.

Beyond computer forensics


Nice photos on irika.lu - photographe mariage :)

Disclaimer


The author of Guymager and these pages is not responsible, not liable nor anything else for the content of extern web pages that are linked on this website nor for extern web pages linking to this one, nor for anything else. There is no garantuee for any software to work and any software may damage anything.
LPO