Creating hard disk images with Guymager

Cloning

If you want to clone a device, Guymager offers you a slightly different procedure: Just as when creating an image, you right-click in the main window on the device you want to clone and then choose Clone device. Now, the software opens a window in which you can see the mass storage devices on the computer system in the top pane.

The storage medium selected as the source device is already marked as the Device to be cloned in the Remark column and is completely grayed out. This eliminates any confusion between the source and target. All other mass storage devices are labeled Ok for cloning, which means that they are eligible as target media. With a mouse click, you then select a suitable mass storage device, and the software highlights it in blue (Figure  3).

Figure 3: For cloning, you have fewer options to set than for creating an image.

If one of the potential targets is too small for the amount of data in the source, the software notifies you and highlights the too-small medium in gray. This device is also no longer available as a target for cloning.

Next, type a path for the Info directory and the file name for the associated file. In the Hash calculation/verification section, select the algorithm to use for checking the integrity of the duplicated disk, just as you did when you created the image. If necessary, enable the checkboxes to verify the source and target. After completing the setup, you can press the button at the bottom right to start creating the image.

Guymager now creates a clone of the original. If the target is a disk with larger capacity than the sources, then the software creates a partition of the same size and with the same filesystem as the source partitions on the device. This means you can access the clone just as you would the original.

Reconstruction

On Linux, you have many tools to help you read the preferred EWF format for creating images. For example, the TestDisk [4] program lets you reconstruct the image. You can easily access a dd-based image on Linux by creating a loop device and then using the mount command to mount it on your system.

Conclusions

Guymager considerably facilitates the process of creating verified images and cloned disks. It helps you back up important data – especially on removable disks – in a short time and as an identical copy. The software is stable and fast, and thanks to its professional functions, it also suitable for use in forensics.

The simple interface still leaves some scope for improvements. It would make more sense for the application to offer a list of buttons for actions to match your selection in the list. The fact that they are hiding in the context menu is not immediately apparent.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Caine

    Caine is a Linux distribution based on Ubuntu 10.04 for forensic scientists and security-conscious administrators. Poised to do battle against IT ne’er-do-wells, Caine has a comprehensive selection of software, a user-friendly GUI, and responsive support.

  • ATA over Ethernet

    We'll show you how to build a network-based virtual RAID solution using ATA over Ethernet.

  • Clonezilla SE

    Managing a network of computers can be an involved process. Clonezilla SE lets you image and roll out multiple machines with ease.

  • BackTrack and Sleuth Kit

    Once you determine a system has been attacked, boot to the BackTrack Live forensics distro and start your investigation with Sleuth Kit.

  • OCFA

    Automate the forensics process with the Dutch police department's Open Computer Forensics Architecture.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News