applications/forensics tools

guymager - Imager for forensic media acquisition

License: GPL
Vendor: cert.org
Description:
guymager is an imager for forensic media acquisition. Its main features are:

    * Easy user interface in different languages
    * Runs under Linux
    * Multi-threaded design, multi-threaded data compression
    * Makes full usage of multi-processor machines
    * Generates flat (dd) and EWF (E01) images

Packages

guymager-0.7.1-1.fc17.src [293 KiB] Changelog by Lawrence R. Rogers (2013-03-15):
* Release 0.7.1-1
  * Duplicate image creation
  * New RunStats module
  * New job queue mechanism
  * New userfield
  * New configuration table for main Guymager table
  * New font configuration
  * New cfg table HiddenDevices
  * New configuration parameter CommandAcquisitionEnd
  * Writing hidden area info into info file
  * Gray out rescan button when scan is running
  * In order to avoid the "contagious error", DirectIO is switched on in fallback mode.
  * Removed race condition where write thread would write hash into image before it has been calculated by hash thread.
  * SHA-1 support added
guymager-0.6.13-1.fc17.src [247 KiB] Changelog by Lawrence R. Rogers (2012-12-27):
* Release 0.6.13-1
  * Package dependency to udisks added (for recent Ubuntu)
  * libparted search extended to subdirs
  * Added cfg parameter ForceCommandGetSerialNumber
guymager-0.6.12-1.fc17.src [509 KiB] Changelog by Lawrence R. Rogers (2012-07-20):
* Release 0.6.12-1
  * Avoiding -O3 / inline compiler bug
  * Correct srceen output if no log file is in use
  * DD verification: retry with NOATIME switched off if open fails
  * DD verification: Do not exit if open fails
guymager-0.6.11-2.fc17.src [483 KiB] Changelog by Lawrence R. Rogers (2012-07-18):
* Release 0.6.11-2
	Built with libguytools 2.0.2
guymager-0.6.11-1.fc17.src [483 KiB] Changelog by Lawrence R. Rogers (2012-07-04):
* Release 0.6.11-1
  * Removed bug where section tables might contain only one entry.
  * New cfg parameter EwfNaming supports 2 methods for naming EWF segment files
  * Added warnings for low space on destination path and large number of image
    files before starting acquisition, new configuration parameters 
    WarnAboutImageSize and WarnAboutSegmentFileCount
  * When opening destination image fails, retry with NOATIME switched off (thus
    enabling cloning without root rights)
  * Removed bug where section tables might contain only one entry.
guymager-0.6.9-1.fc17.src [250 KiB] Changelog by Lawrence R. Rogers (2012-07-29):
* Release 0.6.9-1
  * Releasing all changes of 0.6.8 (switch to new version in order to have test
    users update their packages correctly)
  * AEWF: Considering also 1st chunk base offset when checking if chunk can be
    added to current sectors section.
  * New cfg parameter CheckRootRights
  * If source disk can't be opened, give it another try without option NOATIME
  * Corrected text output for image hash calculation in info file; Translations
    updated.
  * Error in UtilIsZero removed (leading to wrong image if FifoBlockSizeEwf is
    set to values above 65536)
  * Package no longer recommends gksu, smartmontools and hdparm but depends on
    them
  * No longer exits on write errors on info file or in AEWF module (should
    already have been done in 0.6.4, but the takeover from trunk wasn't done)
  * New cfg parameter EwfCompressionThreshold
  * Also include symlinks when searching for libparted
  * Changes from Mika (unistd.h)
guymager-0.6.7-1.fc17.src [245 KiB] Changelog by Guy Voncken (2012-04-30):
* Release 0.6.7-1
  * Configuration parameter CommandGetAddStateInfo now understands placeholder
    %local for distinguishing between local and non-local devices.
  * New configuration parameter QueryDeviceMediaInfo for devices that do not 
    like HPA/DCO querying
  * MD5 calculation of destination disk corrected for disks whose size is not 
    a multiple of the block size
  * no longer depends on libproc (using libc functions instead)
  * New, fast SHA256 and MD5 routines (from package coreutils)
  * No longer depends on libcrypto or libcrypto for fast hash functions

Listing created by Repoview-0.6.5-1.el5