Follow

How do I collect a full disk image using eDiscovery

Created by: Brendan Bone
Created date:
Last Updated date:

Question

How do I collect a full disk image using eDiscovery?

 

Prerequisite

  • A Computer Data Source with the Agent installed.
    Note: It is recommended to perform a "Verify Agent Connectivity" System Job to confirm the target is online and has a working Agent.
  • Sufficient space in your project's Job Data folder (at least the sum of the sizes of all disks/drives attached to the desired target(s)).

 

Answer

  1. In the desired case, add a new Job to start the Job Wizard
  2. In the Job Options section, set the Job Type to "Collection", provide a unique Name, select "Computers" (or "Person's Computers") in Job Target Options, and click Next
    Note: Other options can be specified as desired, but are not necessary.
    2017-08-28_09_40_43-Home_-_Internet_Explorer.png
  3. In the Computers section, select the desired computer target(s) and select Full Disk Acquisition
    2017-08-28_08_49_11-Home_-_Internet_Explorer.png
  4. Expand Advanced Options and choose whether to collect the Logical Disks or Physical Disks, and click Next
    2017-08-28_08_51_44-Home_-_Internet_Explorer.png
  5. Choose the desired Scheduling and Approvers options, then Save the job
  6. Approve and Execute the job

 

Notes

  • eDiscovery will collect images of all disks/drives attached to the target during a Full Disk Acquisition.

 

Overview

This article discusses imaging full drives/disks via eDiscovery.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk