Question

How do I collect System and Registry files with eDiscovery?

 

Answer

  1. Create a new Computer Collection job
  2. In the Job Wizard, in the Computer tab, select the desired Computer targets
  3. Add filters to find the desired System/Registry files (path, file name, etc.)
  4. Under the filters, expand "Advanced Options"
  5. Select "File System" and "System Files"
  6. Proceed to save, approve, and execute the job

 

Overview

Computer Collection jobs require using specific options to gain access to System and Registry files that are typically locked on a target.