guymager: A forensic imaging tool for creating disk images and performing hash verification

Every forensic investigation starts with acquisition, and getting that step wrong ruins everything downstream. Guymager is the tool I trust most for creating forensic disk images on Linux — it’s fast, has a genuinely simple GUI, and bakes hash verification directly into the imaging process so I never have to wonder whether my image is bit-for-bit identical to the source drive.

What Guymager Is and How It Works

Guymager is a C++/Qt-based forensic imager built specifically for Linux. Architecturally, it:

1. Reads the source device sector-by-sector using low-level block I/O
2. Writes the output in your chosen format — raw (dd-style), EnCase EWF (.E01), or AFF
3. Simultaneously computes one or more hashes (MD5, SHA-1, SHA-256) while imaging, rather than as a separate pass afterward
4. Performs a verification pass after acquisition, re-reading the image and comparing it against the recorded hash to prove bit-for-bit accuracy
5. Uses multi-threading to keep imaging speed close to the physical read speed of the source device, rather than being bottlenecked by hash computation

This “hash while imaging, then verify” workflow is exactly what’s expected in a proper chain-of-custody process, and it’s built into the tool by default rather than something I have to bolt on afterward with hashdeep.

Installing Guymager

On Debian/Ubuntu/Kali:

sudo apt update
sudo apt install -y guymager

Guymager needs to run with root privileges since it accesses raw block devices:

sudo guymager

Verify the install:

guymager --version

Basic Workflow

Guymager is primarily GUI-driven (as is standard for forensic imaging tools, given the importance of visual confirmation of source/destination devices), but the workflow is straightforward and reproducible:

1. Launch with sudo guymager — it auto-detects all attached block devices
2. Critical step: confirm you’ve selected the correct source device (never the destination workstation’s own drive) — Guymager displays device size, serial number, and model to help avoid this exact mistake
3. Right-click the device → “Acquire image”
4. Set case information: examiner name, case number, evidence number, description
5. Choose image format (E01 recommended for most forensic suites, raw/dd for maximum tool compatibility)
6. Select hash algorithms (I always enable both MD5 and SHA-256 for redundancy)
7. Start acquisition — Guymager shows real-time progress, speed, and estimated time remaining
8. After completion, Guymager automatically re-reads the image for verification and reports PASS/FAIL against the recorded hash

Example Output

After an acquisition completes, Guymager generates an info file alongside the image:

Case number:        CASE-2026-014
Evidence number:     EVID-01
Examiner:            J. Analyst
Acquisition started: 2026-07-12 09:14:02
Acquisition ended:   2026-07-12 11:42:37
Source:              /dev/sdb (500107862016 bytes)
Image format:        EWF/E01
MD5:                 3a7bd3e2360a3d5f8c9a1e2b4d6f8901
SHA256:               e4b0c882... (truncated)
Verification result:  MD5 verified, SHA256 verified — MATCH

That “MATCH” line is exactly what goes into my chain-of-custody documentation — proof that the image is a perfect, verified copy of the original evidence.

Real-World Use Cases

Criminal and civil digital forensics investigations — imaging a suspect’s hard drive under a proper legal order before any analysis begins.

Corporate incident response — imaging a compromised or terminated employee’s workstation for later analysis in Autopsy, preserving the original evidence untouched.

Data recovery preparation — imaging a failing or physically damaged drive once, so all further recovery attempts (scalpel, magicrescue, etc.) work against the stable image copy rather than risking further damage to fragile original media.

Integration with Other Tools

• hashdeep — I still independently re-verify Guymager’s own hash output with hashdeep as a second, tool-independent confirmation for high-stakes cases.
• Autopsy — the E01/raw image Guymager produces is ingested directly as a data source for full analysis.
• Scalpel/magicrescue/Scrounge-NTFS — any file-carving or recovery work happens against the Guymager-created image, never the original media.

Performance and Troubleshooting

• Imaging speed is generally limited by the source device’s read speed (especially on aging or failing drives) rather than Guymager itself; a write blocker and a fast destination (SSD/RAID) help maximize throughput.
• On a physically failing drive, enable Guymager’s “bad sector” handling options, which will pad unreadable sectors with zeroes and continue rather than aborting the entire acquisition.
• A mistake I’ve seen even experienced examiners make under time pressure: selecting the wrong destination directory on a drive with insufficient free space — Guymager will warn about this, but always double-check available space before starting a multi-hour acquisition.

Best Practices

• Always use a hardware or software write blocker on the source device in addition to Guymager’s own safeguards.
• Enable at least two hash algorithms for redundancy in case one is ever challenged.
• Document the entire acquisition (device serials, case numbers, examiner, start/end times) directly from Guymager’s generated info file into your case management system.

FAQ

Does Guymager run on Windows? No, it’s Linux-only; Windows examiners typically use tools like FTK Imager for equivalent functionality.

What image format should I use? E01 is widely compatible with commercial and open-source forensic suites and includes built-in metadata and compression; raw/dd is the most universally compatible but larger and lacks embedded case metadata.

Can Guymager image a remote/networked drive? Its primary design is for locally attached devices; remote acquisition typically requires different tooling or a network-attached write-blocked setup.

Summary

Guymager is the tool that starts every proper forensic case I work on the right way — fast acquisition, integrated hashing, and automatic verification, all in one auditable step. Getting acquisition right the first time means everything downstream — carving, parsing, timeline analysis — rests on a solid, provably unaltered foundation.

References

• Official project page: https://guymager.sourceforge.io
• SourceForge repository: https://sourceforge.net/projects/guymager/