Guymager
5.7#26 in digital forensics softwareFree planFree planLinux
VisitGuymager vs Plaso
What both publish
| Fact | Guymager | Plaso |
|---|---|---|
| Integrations | The maker lists Guymager as included on several forensic live CDs and virtual machines, including CAINE, TSURUGI, BACKBOX, Kali, GRML, ForLEx, SANS SIFT, and BitCurator. | The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. |
| Purpose | Guymager is a forensic imager for acquiring media. | Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis. |
| Support | The author accepts problem reports by email and asks users to attach the Guymager log file. | The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort. |
Guymager plans
- GuymagerFree
Plaso plans
- Open-source Plaso packageFree
- PlasoFree
Pick Guymager if…
Guymager suits Linux users who need to acquire or clone storage devices and removable media for forensic work. It is available as a free, open-source imager.
Pick Plaso if…
Plaso suits digital forensic practitioners who need to collect and analyze timelines from files, devices, logs, or storage images. Its parser and plug-in framework may also suit users extending forensic workflows.