How do I collect a full disk image using eDiscovery?



  • A Computer Data Source with the Agent installed.
    Note: It is recommended to perform a "Verify Agent Connectivity" System Job to confirm the target is online and has a working Agent.
  • Sufficient space in your project's Job Data folder (at least the sum of the sizes of all disks/drives attached to the desired target(s)).



  1. In the desired case, add a new Job to start the Job Wizard
  2. In the Job Options section, set the Job Type to "Collection", provide a unique Name, select "Computers" (or "Person's Computers") in Job Target Options, and click Next
    Note: Other options can be specified as desired, but are not necessary.
  3. In the Computers section, select the desired computer target(s) and select Full Disk Acquisition
  4. Expand Advanced Options and choose whether to collect the Logical Disks or Physical Disks, and click Next
  5. Choose the desired Scheduling and Approvers options, then Save the job
  6. Approve and Execute the job



  • eDiscovery will collect images of all disks/drives attached to the target during a Full Disk Acquisition.



This article discusses imaging full drives/disks via eDiscovery.