Guymager
Guymager is a free Linux forensic imager for acquiring storage devices and removable media.
What Guymager is
Guymager is a free Linux forensic imager for acquiring storage devices and removable media. It creates flat dd, EWF (E01) and AFF images, and supports disk cloning. Its multithreaded, pipelined design and multithreaded compression are intended to use multiple processors for imaging. The author says it calculates a hash of source data packed into an EWF image and can optionally calculate hashes for generated image files. Users can configure local hard disk serial numbers so those disks are marked and cannot be acquired, helping avoid selecting them by mistake. Acquisition and cloning dialogs can be adapted by adding or removing fields and setting static or dynamic defaults. The interface is available in different languages. Version 0.8.x scans attached devices with libudev rather than relying on udisks. Installation is described for Debian, Ubuntu, Debian-based Linux systems and RPM packages. Guymager is included on several forensic live CDs and virtual machines. The author accepts problem reports by email and asks users to attach the program log.
Good
- Creates dd, EWF/E01 and AFF images
- Supports disk cloning
- Can calculate hashes for image files
- Configured local disks cannot be acquired
- Acquisition dialogs can be customized
Watch out
- Linux only
- No command-line version was reported in a 2018 wiki discussion
Who it suits
Guymager suits Linux users who need to acquire or clone storage devices and removable media for forensic work. It is available as a free, open-source imager.
Verdict
Guymager offers disk acquisition, cloning and image verification options on Linux at no cost. Users who need command-line operation should note the author's 2018 statement that no such version was available then.
Plans and prices
From Guymager's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Guymager | Free | Linux forensic imager · open source |
The facts
Each one read from Guymager's own pages, with the date it was checked.
What it does
- Configuration
- Users can adapt acquisition and cloning dialogs by adding or removing fields and setting static or dynamic default values.checked 8 Oct 2026
- Image formats
- It generates flat (dd), EWF (E01), and AFF images, and supports disk cloning.checked 8 Oct 2026
- Installation
- The maker describes installation on Debian, Ubuntu, Debian-based Linux systems, and via RPM packages.checked 8 Oct 2026
- Integrations
- The maker lists Guymager as included on several forensic live CDs and virtual machines, including CAINE, TSURUGI, BACKBOX, Kali, GRML, ForLEx, SANS SIFT, and BitCurator.checked 8 Oct 2026
- Interface
- The user interface is available in different languages.checked 8 Oct 2026
- Limit
- The author stated in a 2018 wiki discussion that Guymager had no command-line version at that time.checked 8 Oct 2026
- Performance
- Its multithreaded, pipelined design and multithreaded data compression are intended to make imaging fast and use multiple processors.checked 8 Oct 2026
- Purpose
- Guymager is a forensic imager for acquiring media.checked 8 Oct 2026
- Support
- The author accepts problem reports by email and asks users to attach the Guymager log file.checked 8 Oct 2026
- Verification
- The author says Guymager calculates a hash of the source data packed into an EWF image and can optionally calculate hashes for generated image files.checked 8 Oct 2026
Where it runs
- Device detection
- Version 0.8.x uses libudev to scan attached devices instead of relying on udisks.checked 8 Oct 2026
- Device protection
- Local hard disks identified by configured serial numbers are marked and cannot be acquired, to help prevent selecting the wrong disk.checked 8 Oct 2026
Alternatives to Guymager
- 1
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 2
Plaso
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 3
CAINE
Free planOpen sourceLinuxSelf-hostedWindows7.1Free plan - 4
Paraben E3 Forensic Platform
AndroidiOSLinuxmacOS7.1From $699 a year - 5
OSForensics
Free planAndroidSelf-hostedWindows7.0From $945 a year - 6
NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time