Question

How do I collect a full disk image using eDiscovery?

 

Prerequisite

  • A Computer Data Source with the Agent installed.
    Note: It is recommended to perform a "Verify Agent Connectivity" System Job to confirm the target is online and has a working Agent.
  • Sufficient space in your project's Job Data folder (at least the sum of the sizes of all disks/drives attached to the desired target(s)).

 

Answer

  1. In the desired case, add a new Job to start the Job Wizard
  2. In the Job Options section, set the Job Type to "Collection", provide a unique Name, select "Computers" (or "Person's Computers") in Job Target Options, and click Next
    Note: Other options can be specified as desired, but are not necessary.
    https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009876499/original/2017-08-28_09_40_43-Home_-_Internet_Explorer.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T165700Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=d8ebe2c66f8fedbe69f994e90f1eae746b3dc21fbbefcefabd2937124b9852cb
  3. In the Computers section, select the desired computer target(s) and select Full Disk Acquisition
    https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009876500/original/2017-08-28_08_49_11-Home_-_Internet_Explorer.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T165700Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=b2a7c445af001825f8f329f47f5a016ec710e7d0db450f94b5c141173fa909b3
  4. Expand Advanced Options and choose whether to collect the Logical Disks or Physical Disks, and click Next
    https://s3.amazonaws.com/cdn.freshdesk.com/data/helpdesk/attachments/production/69009876501/original/2017-08-28_08_51_44-Home_-_Internet_Explorer.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAS6FNSMY2XLZULJPI%2F20210926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210926T165700Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=ee2a99aaa3c956488a87c351937676d5eb1f1dddc05c108647efa4de226f30be
  5. Choose the desired Scheduling and Approvers options, then Save the job
  6. Approve and Execute the job

 

Notes

  • eDiscovery will collect images of all disks/drives attached to the target during a Full Disk Acquisition.

 

Overview

This article discusses imaging full drives/disks via eDiscovery.