Capturing a forensic image with guymager

We looked at how to analyze an image with the volatility framework in the Using the volatility framework recipe. In this recipe, we will learn how these images can be created. We will use a free tool, guymager, which is a forensic imager for media acquisition; it is available for Linux only.

How to do it...

Please observe the following steps:

1. Guymager is already available in Kali Linux. Run it using the following command:

guymager &

Running the preceding command, we get the following screen:

2. Connect the device (USB/CD) that you want to clone. In our case, it's the CD drive. If the device connects after running the tool, click the Rescan button so that the tool can recognize...