Guymager: free forensic imager for media acquisition

Guymager [ˈgɪmɪdʒər] is a free forensic imager for media acquisition. Its main features are:

  • Easy user interface in different languages
  • Runs under Linux
  • Really fast, due to multi-threaded, pipelined design and multi-threaded data compression
  • Makes full usage of multi-processor machines
  • Generates flat (dd), EWF (E01) and AFF images, supports disk cloning
  • Free of charges, completely open source


  • The connected storage devices are listed in the upper part. New devices can be connected at any time – press the rescan button for displaying them.
  • The devices marked with light red color are local hard disks. They cannot be acquired, thus preventing from acquiring the wrong disks. Local hard disks are recognized by their serial numbers which can be entered in the configuration file.
  • The lower part shows more detailed info about the acquisition currently selected by the blue cursor.


sudo apt-get install guymager