How do I collect a full disk image using eDiscovery?
- A Computer Data Source with the Agent installed.
Note: It is recommended to perform a "Verify Agent Connectivity" System Job to confirm the target is online and has a working Agent.
- Sufficient space in your project's Job Data folder (at least the sum of the sizes of all disks/drives attached to the desired target(s)).
- In the desired case, add a new Job to start the Job Wizard
- In the Job Options section, set the Job Type to "Collection", provide a unique Name, select "Computers" (or "Person's Computers") in Job Target Options, and click Next
Note: Other options can be specified as desired, but are not necessary.
- In the Computers section, select the desired computer target(s) and select Full Disk Acquisition
- Expand Advanced Options and choose whether to collect the Logical Disks or Physical Disks, and click Next
- Choose the desired Scheduling and Approvers options, then Save the job
- Approve and Execute the job
- eDiscovery will collect images of all disks/drives attached to the target during a Full Disk Acquisition.
This article discusses imaging full drives/disks via eDiscovery.