Activity for guy
-
guy posted a comment on ticket #13
Hello Yossi, I'm astonished to read this. In my understanding, a touch screen principally should behave like a mouse. I never made any tests on a touch screen system for the simple reason that I don't have one readily available. Maybe I could try to lend one for a test. Which Linux distro and version are you using? Did you try to compile Guymager yourself on your system to see if it behaves differently then?
-
Dear Subham, sorry for the late reply - the entire "Guymager Support Team" (me) was on holiday. Sorry to disappoint you: A CLI version has been asked several times, but still is not available due to lack of time. Best wishes Guy
-
Dear Subham, sorry for the late reply - the entire "Guymager Support Team2 (me) was on holiday. Sorry to disappoint you: a CLI version has been asked several times, but still is not available due to lack of time. Best wishes Guy
-
Dots in Filename and description
-
Ticket moved from /p/guymager/feature-requests/18/
-
Hallo "John Doe", english version -> see below. wenn jemand von "Festplatten" spricht, dann denke ich, dass ich auf Deutsch antworten kann ;-) Ja, zusätzliche Zeichen in Dateinamen sind ohne weiteres möglich. Nur eben habe ich die Standardkonfiguration so gewählt, dass möglichst keine Probleme beim späteren Kopieren auftreten. Bitte sieh Dir den Parameter SpecialFilenameChars in /etc/guymager/guymager.cfg an (in der Datei findest Du übrigens auch die ganze Konfigurations-Dokumentation, da kann man...
-
Danke für die netten Worte! Unter develop@faert.net kannst Du mich gerne auch direkt kontaktieren.
-
Danke für die netten Worte! Kannst Du mich bitte kurz direkt kontaktieren unter develop@faert.net ?
-
Hallo "John Doe", english version -> see below. wenn jemand von "Festplatten" spricht, dann denke ich, dass ich auf Deutsch antworten kann ;-) Ja, zusätzliche Zeichen in Dateinamen sind ohne weiteres möglich. Nur eben habe ich die Standardkonfiguration so gewählt, dass möglichst keine Probleme beim späteren Kopieren auftreten. Bitte sieh Dir den Parameter SpecialFilenameChars in /etc/guymager/guymager.cfg an (in der Datei findest Du übrigens auch die ganze Konfigurations-Dokumentation, da kann man...
-
Hallo "John Doe", wenn jemand von "Festplatten" spricht, dann denke ich, dass ich auf Deutsch antworten kann ;-) Ja, zusätzliche Zeichen in Dateinamen sind ohne weiteres möglich. Nur eben habe ich die Standardkonfiguration so gewählt, dass möglichst keine Probleme beim späteren Kopieren auftreten. Bitte sieh Dir den Parameter SpecialFilenameChars in /etc/guymager/guymager.cfg an (in der Datei findest Du übrigens auch die ganze Konfigurations-Dokumentation, da kann man recht viel machen). Mögliche...
-
Guymager version 0.8.13
-
I added keyboard support in my trunk. You'll be able to get the context menu by pressing Space or Enter. The complete sequence for starting an acquisition without pointing device would be: 1. Select device with arrow up/down keys 2. Press Space or Enter 3. Select the desired entry in the context menu ("Acquire image") by using the arrow up/down keys, then press Enter 4. Navigate through the acquisition dialog by using TAB / SHIFT TAB for switching to next/prev element Arrow keys for changing the...
-
Many thanks for your kind words. I just tried it myself and indeed - as stupid as it sounds - you can't acquire a device without a mouse! You're completely right, this must be fixed! I found a solution that might work as a very last possibility. You need internet connection for it (I know, that's not allowed in many cases): 1. CTRL-ALT-T for getting a shell 2. sudo apt install xdotool 3. Move the mouse to correct position over the Guymager device line. Do it with xdotool mousemove 500 500 (you'll...
-
Many thanks for your kind words. I just tried it myself and indeed - as stupid as it sounds - you can't acquire a device without a mouse! You're completely right, this must be fixed! I found a solution that might work as a very last possibility. You need internet connection for it (I know, that's not allowed in many cases): 1. CTRL-ALT-T for getting a shell 2. sudo apt install xdotool 3. Move the mouse to correct position over the Guymager device line. Do it with xdotool mousemove 500 500 (you'll...
-
Building Guymager 0.8.12 on Debian 10 Buster
-
Building Guymager 0.8.12 on Debian 10 Buster
-
Building Guymager 0.8.12 on Debian 10 Buster
-
Building Guymager 0.8.12 on Debian 10 Buster
-
Building Guymager 0.8.12 on Debian 10 Buster
-
invalid dates and Target date error
-
Closed - not a Guymager bug
-
Those meta data fields (Timestamps, Case number, Examiner, Notes, Evidence number etc.) are simply glued together with TABs. Together with some more texts they form one big string, So, the format is simplistic and I have no idea what's going wrong in Encase. You would have to ask the developers. To me, it looks like an Encase bug, because I never had such feedback for other software. I always recommed to check with libewf (by Joachim Metz) in case of problems. I cannot exlcude that the occurence...
-
For now: I suppose it's an Encase bug and is related to Encase not interpreting the EWF header correctly. What you could try: Launch Guymager with option "AvoidEncaseErrors". From the documentation: AvoidEncaseProblems -- Encase produces strange error messages if the EWF internal fields "Imager Version" and "OS Version" contain more than 11 or 23 characters, respectively. Leave this flag OFF if you don't work with Encase (default setting). Set it to ON if ever you work with Encase and want to avoid...
-
Thanks, rooibost, I'm glad to hear that Guymager found its way down to ZA :-) Concerning your date problem: Could you please verify with a third, independent tool? I would suggest that you use ewfinfo. It should be contained on the Kali Linux you use. Call it like this: ewfinfo ImageName.E* You must pass all segment files to ewfinfo. Have a look at the two output lines named "Acquisition date" and "System date".
-
Also, is there a tehnical, or other, reason why verification of image could not start some time after image creation begins My reasons: It's a question of looking at the image (set of segment files) as a whole. Get one job done and do the other one next. I would not feel good when starting verification on an image that has not been completely written yet. Depending on the target device, this would lead to a lot of disk head movements. That would slow down the write AND the verification process. Yes,...
-
Guymager supports SHA256, but it won't get written to the resulting EWF file (as it is not supported there). It's contained in the info file only. would use sha512 and would truncate the hash to first 40 characters, the result would be the same as using sha256 I cannot confirm this... while SHA256 and SHA512 have similar algorithms, they produce completely different hashes, I think!? Could you please show me an example (C-Code, Python-Code, Linux shell, ...) that would show me how to use SHA512 for...
-
Please have a look at my response in ticket #16 https://sourceforge.net/p/guymager/feature-requests/16/
-
Hello dasd, I saw that you posted the same feature request twice, so I permitted myself to delete the previous one. Concerning the compression algorithms: For the EWF format, I cannot simply switch to a different algorithm, as no software out there would be able to read such EWF files. The same is true for hashing: No algorithm other then those supported by the standard (see Joachim Metz' outstanding documentation) will ever be supported. Yes, it's true that SHA512 is faster, however, we can't take...
-
Hello bkl, I had a look at the AFF4 documentation. Unfortunately, I can't say that it's written a way that would allow me to support AFF4 easily. I then tried to compile aff4imager myself (current version, i.e. 1.0) and managed to do so in the end. However, there are some bugs. For example, I get a floating point error when trying to view the metadata from the reference image named Base-Linear.aff4 with option -V. Using the AFF4 C/C++ library from within Guymager possibly could be an option, but...
-
Encase verification errors E01 image, Imaged using Guymager
-
got no reply - therefore closed
-
Guymager version 0.8.12
-
Mark, Guymager just does a complete image of the media (HDD, SDD, ...). I can't tell you what possibilities you have with Axiom or other commercial products, as I do not use those. The image done by Guymager complies to the standard formats used in forensics, i.e. EWF or RAW (dd) - and this format is independent of the OS that was installed on the HDD that you imaged. What do you mean by "facial recognition" or "pin"? Do you mean that the original computer only could be unlocked by putting the correct...
-
Mark, Guymager just does a complete image of the media (HDD, SDD, ...). I can't tell you what possibilities you have with Axiom or other commercial products, as I do not use those. The image done by Guymager complies to the standard formats used in forensics, i.e. EWF or RAW (dd) - and this format is independent of the OS that was installed on the HDD that you imaged. What do you mean by "facial recognition" or "pin"? Do you mean that the original computer only could be unlocked by putting the correct...
-
Hello Kelum, you're describing two different problems here. Let's start with easy one: The Encase problem. There is no reason for limiting those comment strings to 64 or even only 12 characters. The EWF format (as documented by Joachim Metz) has no such limits and every software should be able to handle much longer strings. If Encase would complain only once about its inability to handle those strings, the user could still live with it. However, the annoying Encase error pops up again and again....
-
Ticket moved from /p/guymager/bugs/10/
-
Building Guymager for OpenSuse
-
Guymager version 0.8.11
-
libguytools version 2.1.0
-
Hehe, looks good! Nice work! If I may just add a small remark: Please do not change /etc/guymager/guymager.cfg directly. Create a new file /etc/guymager/local.cfg and put the line Language = en_CH into it. The idea behind: If an update is going to be installed, your change would be overwritten if it resides in guymager.cfg. As local.cfg is loaded later (see INCLUDE statement at the end of guymager.cfg) the settings residing there overwrite those from earlier configuration files. Another remark: It's...
-
Hello Euan, you currently could change the names by creating a new language file. However, I must admit that this might be too complicated for the standard user. Would you like me to create one for you? You could then tell me if it fits your request. If yes, please send me your "translations" for case number description examiner evidence number notes Remark: Please be aware of the fact that those text fields will keep the original labels inside the EWF files . This is due to the fact, that the EWF...
-
Hello Euan, you currently could change the names by creating a new language file. However, I must admit that this might be too complicated for the standard user. Would you like me to create one for you? You could then tell me if it fits your request. If yes, pleasse send me your "translations" for case number description examiner evidence number notes Guy
-
Hello Euan, you currently could change the names by creating a new language file. However, I must admit that this might be too complicated for the standard user. Would you like me to create one for you? You could then tell me if it fits your request. If yes, pleasse send me your "translations" for case number description examiner evidence number * notes Guy
-
APFS Container - APFS - Support
-
Good morning Bruno, as Guymager doesn't care about file systems: If you want a HDD image then acquire the whole disk. As you're able to mount the partition directly from the original disk now you also will be able to mount it from the EWF or DD image. If you just want an image of the partition: Use the "add special device" function of Guymgaer and enter /dev/sdxN, where x is your device letter and N is the partition number. If you want a logical copy of the files in the APFS partition then Guymager...
-
Eddy, I think you already found the solution yourself: "not technically empty". I added the compression option "empty" for systems with poor CPU performance. For example, when imaging many PCs in a company, where I then use the PCs themselves for doing the images (booted from Linux live sticks). Those office PCs often are low cost systems with cheap Intel CPUs. For "empty" to work there must be whole chunks filled with only zeroes. A chunk is the block size used in EWF, it very often is 32K. So,...
-
Eddy, I think you already found the solution yourself: "not technically empty". I added the compression option "empty" for systems with poor CPU performance. For example, when imaging many PCs in a company, where I then use the PCs themselves for doing the images (booted from Linux live sticks). Those office PCs often are low cost systems with cheap Intel CPUs. For "empty" to work there must be whole chunks filled with only zeroes. A chunk is the block size used in EWF, it very often is 32K. So,...
-
Eddy, I think you already found the solution yourself: "not technically empty". I added the compression option "empty" for systems with poor CPU performance. For example, when imaging many PCs in a company, where I then use the PCs themselves for doing the images (booted from Linux live sticks). Those office PCs often are low cost systems with cheap Intel CPUs. For "empty" to work there must be whole chunks filled with only zeroes. A chunk is the block size used in EWF, it very often is 32K. So,...
-
You always may contact me directly by email via develop at faert point net if you like. It's easier than using a wiki (and more adequate as well).
-
You wrote: Neither of the md5 hashes for those .E01 files match the original md5 hash generated by Guymager at the time of the image completion. and It does not match the hash generated by Guymager upon completion of the imaging The MD5 hash calculated by Guymager (and by any other imager that exists) is always the hash of the original source data packed into the E01 file. As the E01 file also includes its own EWF structures and some meta data it's just normal that the MD5 of the whole E01 file is...
-
I would guess: No, Guymager's EWF files won't be described separately. I think there's no sense in doing so. Other imagers are missing as well - and Joachim surely has other things to do than re-running every imager with every version update ; ) BTW: if you need a tool for accessing EWF files under Linux then have a look at xmount.
-
Concerning compression According to my experience, when it comes to compression level, people always have the same philosophy: Max, none, only compress if all zeroes, ... That's why I didn't add it to the acquisition dialogue. I do not want to add GUI elements that need to be adjusted again and again. Instead, use the configuration file for setting your preferred compression level. The default value used by Guymager is "fast". Let's suppose you want to change it to "best". You do it this way: Create...
-
Concerning compression According to my experience, when it comes to compression level, people always have the same philosophy: Max, none, only compress if all zeroes, ... That's why I didn't add it to the acquisition dialogue. I do not want to add GUI elements that need to be adjusted again and again. Instead, use the configuration file for setting your preferred compression level. The default value used by Guymager is "fast". Let's suppose you want to change it to "best". You do it this way: Create...
-
Concerning compression According to my experience, when it comes to compression level, people always have the same philosophy: Max, none, only compress if all zeroes, ... That's why I didn't add it to the acquisition dialogue. I do not want to add GUI elements that need to be adjusted again and again. Instead, use the configuration file for setting your preferred compression level. The default value used by Guymager is "fast". Let's suppose you want to change it to "best". You do it this way: Create...
-
Guy, Thank you very much for your help. This is the first e-mail I received from you in days. In fact, I was missing your normal promptness in replying, but I thought that was due to your holidays. I really appreciate this information and your courtesy in making this available. I will let you know the outcome, Best wishes, Lautaro Barrera
-
Lautaro, I tried several times to join you. I replied to your questions as usual by email, but somehow, SF didn't put my latest responses here. It's only now, after logging to SF that I see this. (SF starts to become more and more annoying...) I also contactet you directly by email... didn't that work? Here's my answer (sent on 4. Sept. 2018): Copy the attached file to /etc/guymager/local.cfg (root rights needed). Then launch Guymager and start an acquisition. You'll see that many fields have changed....
-
Fixed values for the text fields are very easy to do. I'll send you something this evening - I'm on holiday but I'll probably find some minutes...
-
Thank you! Lautaro Barrera B.
-
Yes, more or less clear. Question: How do you generate the text file? Will this be done by some script? Guy
-
Thank you Guy!! What I need is to fill all the fields in the Guymager screen taken the data from a text file. We normally take 5-10 images and some of the corresponding fields are the same for various or all images and others (like the image name) are unique... so it would ideal to run some sort of script that starts Guymager, fill all fields in the starting screen with the appropriate values and then start the image (of course after choosing E01 or DD) ... I hope have properly explained what I need,...
-
Yes, that's possible. Two ways of doing it: 1) The hard way: You read /etc/guymager/guymager.cfg where everything is documented 2) The easy way: You tell me what you need and I'll provide you with a personal cfg file for you that you may refine afterwards BTW: Guymager 0.8.9 will be released in 3-4 weeks. Guy
-
Hello, no, there is currently no command line version. It has been asked several times but I did find yet the time for doing it. Greetings Guy
-
Thanks Guy, I very much appreciate your prompt reply. Now, is there a way to parse programmatically the fields required to Guymager to run ? I meant a way to fill the corresponding text box automatically somehow? Best, Lautaro Barrera Lautaro Barrera B. www.e-forensicsinc.comhttp://www.e-forensicsinc.com
-
Fixed values for the text fields are very easy to do. I'll send you something this evening - I'm on holiday but I'll probably find some minutes... On 2. September 2018 19:15:23 GMT+02:00, guy gvoncken@users.sourceforge.net wrote: Yes, more or less clear. Question: How do you generate the text file? Will this be done by some script? Guy On 2018-09-02 19:01, L Barrera wrote: Thank you Guy!! What I need is to fill all the fields in the Guymager screen taken the data from a text file. We normally take...
-
Yes, more or less clear. Question: How do you generate the text file? Will this be done by some script? Guy On 2018-09-02 19:01, L Barrera wrote: Thank you Guy!! What I need is to fill all the fields in the Guymager screen taken the data from a text file. We normally take 5-10 images and some of the corresponding fields are the same for various or all images and others (like the image name) are unique... so it would ideal to run some sort of script that starts Guymager, fill all fields in the starting...
-
Yes, that's possible. Two ways of doing it: 1) The hard way: You read /etc/guymager/guymager.cfg where everything is documented 2) The easy way: You tell me what you need and I'll provide you with a personal cfg file for you that you may refine afterwards BTW: Guymager 0.8.9 will be released in 3-4 weeks. Guy On 2. September 2018 14:19:48 GMT+02:00, L Barrera lb-forensics@users.sourceforge.net wrote: Thanks Guy, I very much appreciate your prompt reply. Now, is there a way to parse programmatically...
-
Hello, no, there is currently no command line version. It has been asked several times but I did find yet the time for doing it. Greetings Guy On 2. September 2018 03:56:54 GMT+02:00, L Barrera lb-forensics@users.sourceforge.net wrote: Is there a command line version of Guymager, that allows to run the program several times from within a bash script file? If so, where are the command line instructions? Sent from sourceforge.net because you indicated interest in https://sourceforge.net/p/guymager/wiki/Home/...
-
gksu and guymager launch issue
-
Yep! Mika from Debian warned me about it some weeks ago and so I switched to pkexec. I'm glad that the gksudo dependency (which always caused problems) is over.
-
migrate to the latest libewf
-
Guymager version 0.8.8
-
Just two clarifications for the other readers - in order not to mislead them: As expected, it no longer supports EwfFormat When compiling Guymager without libewf it still is perfectly able to generate image files in EWF format. It does so by using its own EWF functions (which is the default configuration anyway). It even still has the EwfFormat configuration parameter. However, it'll only accept one setting, namely "AEWF". That version might not support the latest EnCase There are only small, subtle...
-
I just created a new Guymager test version where I (among other small things) included a flag for compiling without libewf. Contact me via develop at faert dot net if you would like to test it.
-
I just created a new Guymager test version where I (among other small things) included a flag for compiling without libewf. Contact me at develop@faert.net if you would like to test it.
-
Ok, so guymager does not "runs with its own EWF functions, and libewf is no longer used" as you mentioned initially. Well, If you only cite half of my words then the sense becomes a different one. I thought you just would like to recompile Guymager for your own needs. Now that I know that you're working on Pentoo, I can understand your needs and philosophy. However, I do not like to restart the game of adding another series of #ifdefs to my code every time a new libewf is released. My suggestion...
-
In deed, using <> instead of "" for including libewf.h would be a bit nicer. I'll change it in the next release. But it doesn't make any difference as there's no local libewf.h. From the GNU documentation: By default, the preprocessor looks for header files included by the quote form of the directive #include "file" first relative to the directory of the current file, and then in a preconfigured list of standard system directories. For the angle-bracket form #include <file>, the preprocessor’s default...
-
In deed, using <> instead of "" for including libewf.h would be a bit nicer. I'll change it in the next release. But it doesn't make any difference as there's no local libewf.h. From the GNU documentation: By default, the preprocessor looks for header files included by the quote form of the directive #include "file" first relative to the directory of the current file, and then in a preconfigured list of standard system directories. For the angle-bracket form #include <file>, the preprocessor’s default...
-
Do you have a special reason why you would like to use the newest libewf? Since years already, Guymager runs with its own EWF functions which are enabled by default. In other words, libewf is no longer used, except if you do the neccessary change in the configuration file manually. I'm not sure if anybody ever did that... BTW: The reason why I wrote my own EWF functions was that I had enough of adapting Guymager again and again to the many API changes of libewf. Isn't it ironic that you now ask me...
-
Do you have a special reason why you would like to use the newest libewf? Since years already, Guymager runs with its own EWF functions which are enabled by default. In other words, libewf is no longer used, except if you do the neccessary change in the configuration file manually. I'm not sure if anybody ever did that...
-
Hello Vicenzo, Answer 1: Yes, you do so by clicking on "Devices / Add sepcial device". Unfortunately, the Qt selection dialog does not show the devices. You have to enter the partition manually, for instance /dev/sda2. The "special device" will then show up in Guymager's device list and you can acquire it like any other device. Answer 2: We generally use Ubuntu and have automount and autorun switched off. We do not boot with the suspect devices attached, but boot the imager first and then hot plug...
-
I cannot remember that I heard of such a problem. Could it be your editor interpreting the text as something different than UTF8? Could you please send me such an info file (attached in an email to develop at faert.net)?
-
tableau write blocker and guymager
-
Vicenzo, is that what syslog showed the moment after you connected the drive? Did you do it you the way I described, i.e. 1) unplug drive, 2) tail syslog, 3) replug and keep an eye on syslog's output while replugging? If that's the case, then there's simply nothing to see there about your disk. It looks pretty dead. /dev/sda simply seems to be the boot drive, right? Btw, the "failed to flush" messages are not related to your disk drive (it's network stuff). Please try the same with a disk where you...
-
write blocker on x86 architecture
-
Automount in Ubuntu (with Unity or Gnome, also with XFCE in XUbuntu) can be switched off with dconf-editor (install it with apt-get install dconf-editor if you've not already done so). You must launch it as the user that you use for imaging (so, usually not root, but the user that you choose when logging in after booting). You then navigate in the tree to "org.gnome.desktop.media-handling" where you find "automount" and "automount-open" which you switch off both and "autorun-never" which you switch...
-
Automount in Ubuntu (with Unity or Gnome, also with XFCE in Ubuntu) can be switched off with dconf-editor (install it with apt-get install dconf-editor if you've not already done so). You must launch it as the user that you use for imaging (so, usually not root, but the user that you choose when logging in after booting). You then navigate in the tree to "org.gnome.desktop.media-handling" where you find "automount" and "automount-open" which you switch off both and "autorun-never" which you switch...
-
write blocker on x86 architecture
-
Hello Vicenzo, Answer 1: Yes, you do so by clicking on "Devices / Add sepcial device". Unfortunately, the Qt selection dialog does not show the devices. You have to enter the partition manually, for instance /dev/sda2. The "special device" will then show up in Guymager's device list and you can acquire it like any other device. Answer 2: We generally use Ubuntu and have automount and autorun switched off. We do not boot with the suspect devices attached, but boot the imager first and then hot plug...
-
Guymager version 0.8.7
-
Hi Guy, thanks very much. Please, i send you the screenshoot of the tail command. Can you help me to understand it ? Is very tedious this problem. Regarding the use of a properly configured Linux machine I'll write you another email and I will show my doubts about the write blocking techniques. I hope to hear you soon. Best Regards. Vincenzo.
1 >