guymager homepage

Introduction

• Easy user interface in different languages
• Runs under Linux
• Really fast, due to multi-threaded, pipelined design and multi-threaded data compression
• Makes full usage of multi-processor machines
• Generates flat (dd), EWF (E01) and AFF images, supports disk cloning
• Free of charges, completely open source

How it looks

• The connected storage devices are listed in the upper part. New devices can be connected at any time - press the rescan button for displaying them.
• The devices marked with light red color are local hard disks. They cannot be acquired, thus preventing from acquiring the wrong disks. Local hard disks are recognised by their serial numbers which can be entered in the configuation file.
• The lower part shows more detailed info about the acquisition currently selected by the blue cursor.

Installation

Debian and Ubuntu

   sudo apt-get update
   sudo apt-get install guymager

Using the pinguin APT server

1. Add the pinguin server and its public key by executing the following commands:

       sudo wget -nH -rP /etc/apt/sources.list.d/ http://deb.pinguin.lu/pinguin.lu.list
       wget -q http://deb.pinguin.lu/debsign_public.key -O- | sudo apt-key add -

   Currently, i386 and amd64 systems are supported, powerpc packages are available upon request.
2. Execute the following commands:

      sudo apt-get update
      sudo apt-get install guymager-beta

3. Start the program with

      guymager

RPM packages

Manual download and installation of the Debian packages

1. Browse to apt.pinguin.lu, and choose the directory corresponding to your processor architecture (i386 or amd64).
   Remark: amd64 refers to the architecture, not the processor. So, amd64 is ok for both, the AMD and Intel 64 bit processors.
2. Download the guymager-beta package.

1. Open a shell and get root rights
2. Change to the directory with the files you downloaded.
3. Use the following commands for the installation:

      sudo apt-get update
      sudo dpkg -i guymager-beta_xxx_i386.deb
      sudo apt-get -f install

   xxx stands for the version number. In case you have a 64 bit system, replace i386 by amd64.
   The 2^nd command most probably returns some error messages about missing packages. They are installed by executing the 3^rd command.
4. There are 2 recommended packages you should install as well:

      sudo apt-get install smartmontools hdparm

5. Start the program with

      guymager

Configuration and log

• /etc/guymager/guymager.cfg
  The main configuration file. You should not change it, as your changes get lost when installing a new version of guymager.
• /etc/guymager/local.cfg
  Use this file for local changes instead. The parameters adjusted here have precedence over those in guymager.cfg. guymager.cfg includes local.cfg at its very end. If a parameter is set several times, guymager retains the last setting.

   guymager EwfCompression=BEST

• cfg - The configuration file to be used. The default is /etc/guymager/guymager.cfg.
• log - The log file to be used. The default is /var/log/guymager.log.

   guymager cfg="/tests/g_special.cfg" log="/mylogs/guymager.log"

Compiling the source code

• guymager's source is stored in a subversion repository on sourceforge. Go to the developer page of the guymager project and follow the instructions given there (execute the command starting with "svn co ...", you need to have subversion installed).
• The same procedure applies to libguytools.
• The sources for libewf can be downloaded directly from sourceforge. Go to the libewf project and choose "Browse all files". Choose the latest non-beta release (20100226 at the time of this writing) and download the ".tar.gz" file.

1. Unpack the archive
2. Compile and install with the standard command trio configure, make, make install. Missing libs and tools have to be installed, refer to the error messages. You probably have to go several times through the "install missing libs / configure" cycle until everything is ok.
3. After successfull completion of the 3 commands, you not only have the lib required by guymager, but the libewf tools as well. So, it's easy to check if libewf works fine. Try for instance to run ewfinfo on a EWF (E01) image if you have one available. Try ewfacquire on a memory stick otherwise (see the man pages for details).

1. Change to the directory where you did the subversion checkout, go to the subdir tags and further down to the latest version.
2. To compile libguytools:

      ./create_version_file.sh

      qmake trunk.pro

      make

   Most probably, there will be some tools or libs missing, for instance the Qt developer stuff (libguytools uses qmake). The same procedure as before applies (install/retry/install...). Some of the commands and libs required can be found in different Qt versions and packages. In this case, always choose Qt version 4.
3. Next, a statically linkable version of the lib is built:

   qmake toolsstatic.pro

   make

4. There is no installation procedure (except for Debian, see above). After completion of the previous step, the lib is in the subdirectory lib. Copy it to a location that is included in the search path on your system (this could be /usr/local/lib, for instance) or redirect the LD_LIBRARY_PATH environment variable.
5. Make the headers from the subdirectory "include" available to other applications (for instance by copying to /usr/local/include).

1. Change to the directory where you did the subversion checkout, go to the subdir tags and further down to the latest version.
2. Create the Makefile:

      qmake

3. Compile:

      make

   If ever you have problems with the include path of libguytools: You can add it in the file guymager.pro (re-execute qmake afterwards).
4. Create the language files:

      lrelease guymager.pro

5. Copy the configuration file guymager.cfg to /etc/guymager/

   ./guymager

1. Make sure you have the package dpkg-dev installed.

      sudo apt-get install dpkg-dev

2. Unpack libewf, change into the directory and execute

   dpkg-buildpackage -B -uc -rfakeroot

Follow the instructions given. Most probably, you will be told to install some additional packages before the compilation and packaging can begin. At the end you will get .deb packages in the directory above.
3. Do the same for libguytools.
4. Do the same for guymager. You will be told to install some of the packages you created in the previous steps (libguytools, libguytools1-dev, libewf and libewf-dev). Install these packages by means of dpkg -i (see above for the usage of dpkg).

Live CDs with guymager

Guymager is contained on several live CDs. Some of them are updated more often than others, so, take care to chose one with a recent version of Guymager.

• GRML
• DEFT
• CAINE
• Matriux
• DFLCD
• Forlex
• Forens*nix
• PeriBR
• FCCU

Contact

Disclaimer