Guymager homepage

Introduction

• Easy user interface in different languages
• Runs under Linux
• Really fast, due to multi-threaded, pipelined design and multi-threaded data compression
• Makes full usage of multi-processor machines
• Generates flat (dd), EWF (E01) and AFF images, supports disk cloning
• Free of charges, completely open source

How it looks

• The connected storage devices are listed in the upper part. New devices can be connected at any time - press the rescan button for displaying them.
• The devices marked with light red color are local hard disks. They cannot be acquired, thus preventing from acquiring the wrong disks. Local hard disks are recognised by their serial numbers which can be entered in the configuration file.
• The lower part shows more detailed info about the acquisition currently selected by the blue cursor.

Installation

Debian and Ubuntu

   sudo apt-get update
   sudo apt-get install guymager

Using the pinguin APT server

1. Add the pinguin server and its public key by executing the following commands:

    sudo wget -nH -rP /etc/apt/sources.list.d/ http://deb.pinguin.lu/pinguin.lu.list
       wget -q http://deb.pinguin.lu/debsign_public.key -O- | sudo apt-key add -

   Currently, i386 and amd64 systems are supported, powerpc packages are available upon request.
2. Execute the following commands:

      sudo apt-get update
      sudo apt-get install guymager-beta

3. Start the program with

   guymager

RPM packages

Manual download and installation of the Debian packages

1. Browse to deb.pinguin.lu, and choose the directory corresponding to your processor architecture (i386 or amd64).
   Remark: amd64 refers to the architecture, not the processor. So, amd64 is ok for both, the AMD and Intel 64 bit processors.
2. Download the guymager-beta package.

1. Open a shell and get root rights
2. Change to the directory with the files you downloaded.
3. Use the following commands for the installation:

      sudo apt-get update
      sudo dpkg -i guymager-beta_xxx_amd64.deb
      sudo apt-get -f install

   xxx stands for the version number. In case you have a 32 bit system, replace amd64 by i386.
   The 2^nd command most probably returns some error messages about missing packages. They are installed by executing the 3^rd command.
4. There are 2 recommended packages you should install as well:

   sudo apt-get install smartmontools hdparm

5. Start the program with

   guymager

Configuration and log

• /etc/guymager/guymager.cfg
  The main configuration file. You should not change it, as your changes get lost when installing a new version of guymager.
• /etc/guymager/local.cfg
  Use this file for local changes instead. The parameters adjusted here have precedence over those in guymager.cfg. guymager.cfg includes local.cfg at its very end. If a parameter is set several times, guymager retains the last setting.

guymager EwfCompression=BEST

• cfg - The configuration file to be used. The default is /etc/guymager/guymager.cfg.
• log - The log file to be used. The default is /var/log/guymager.log.

guymager cfg="/tests/g_special.cfg" log="/mylogs/guymager.log"

Compiling the source code

• Guymager's source is stored in a subversion repository on sourceforge. Go to the code page of the Guymager project and follow the instructions given there (execute the command starting with "svn checkout ..."; you need to have subversion installed).
• The same procedure applies to libguytools.
• The sources for libewf can be downloaded from different places. I recommend version 20140608, which has been thoroughly tested with Guymager. You may download it from the Fedora project, for example, or search the web for the libewf-20140608tar.gz.

1. Unpack the archive
2. Set environment variable CFLAGS="-fPIC", then compile and install with the standard triplet 'configure / make / make install'. Missing libs and tools have to be installed, refer to the error messages. You probably have to go several times through the "install missing libs / configure" cycle until everything is ok.
3. If ever you encounter error messages of the type 'undefined reference libuna...' then you probably have a newer version of the C compiler and need to adapt libewf. Edit the file libuna/libuna_extern.h and comment in the word "extern" at the end of the file.
4. If some of the previous libuna error messages persist then edit file libuna/libuna_base32_stream.h and modify the prototype for function libuna_base32_character_copy_to_quintet by adding the line "LIBUNA_EXTERN \" (make it look just like prototype below).
5. In case the error message "Missing libbfio.h" you probably already have some libbfio parts installed. Force libewf to use its local version of that lib by removing the packages related to libbfio. The packages maybe re-installed after successful compilation.
6. After successful completion, you not only have the lib required by Guymager, but the libewf tools as well. So, it's easy to check if libewf works fine. Try for instance to run ewfinfo on a EWF (E01) image if you have one available. Try ewfacquire on a memory stick otherwise (see the man pages for details).

1. Change to the directory where you did the subversion checkout, go to the subdir tags and further down to the latest version.
2. To compile libguytools:

   ./create_version_file.sh

   qmake -qt=qt5 trunk.pro

   make

   Most probably, there will be some tools or libs missing, for instance the Qt developer stuff (libguytools uses qmake). The same procedure as before applies (install/retry/install...). Some of the commands and libs required can be found in different Qt versions and packages. In case of doubt, choose Qt version 5.
3. Next, a statically linkable version of the lib is built:

qmake -qt=qt5 toolsstatic.pro

make

4. There is no installation procedure (except for Debian, see above). After completion of the previous step, the lib is in the subdirectory lib. Copy it to a location that is included in the search path on your system (this could be /usr/local/lib, for instance) or redirect the LD_LIBRARY_PATH environment variable.
5. Make the headers from the subdirectory "include" available to other applications (for instance by copying to /usr/local/include).

1. Change to the directory where you did the subversion checkout, go to the subdir tags and further down to the latest version.
2. Create the Makefile:

   qmake -qt=qt5

   Alternatively, if you prefer not to use libewf, you may generate the Makefile like this:

   qmake -qt=qt5 DEFINES*="ENABLE_LIBEWF=0"

   Even without libewf, Guymager still is perfectly able to generate EWF files.
3. Compile:

   make

   If ever you have problems with the library path of libguytools or libewf: Have a look at the end of file guymager.pro and adapt the LIBS statements according to the path where you put the libs. Re-execute qmake when changing guymager.pro.
4. Create the language files:

   lrelease guymager.pro

5. Copy the configuration file guymager.cfg to /etc/guymager/

./guymager

Live CDs with Guymager

Guymager is contained on several live CDs and VMs. Some of them are updated more often than others. Take care to chose one with a recent version of Guymager.

• CAINE
• TSURUGI
• BACKBOX
• KALI
• GRML
• ForLEx
• SANS SIFT (Vmware image)
• BitCurator (Live CD and VirtualBox image)

Broken EWF images

• The segment files were stored on DVDs some years ago and now, some of the DVDs produce read errors.
• A NAS stores data inconsistently (there's one NAS manufacturer that is known for this horrible bug).
• The disk that was used for storing the image segment files has bad sectors.
• One of the segment files was deleted by accident.

Contact

Beyond computer forensics

Disclaimer