Forensic collection from SharePoint - not sure exactly what you mean but as others here are ignoring the disk imaging options I'll do the same.
Sherpa Software's Discovery Attender for Exchange (don't let the title fool you) has a SharePoint Connector that I've used. I've always found it real easy to create the documentation using DAE, gives you everything you need i.e. who searched for what from where and when, and what they did with it (e.g. exported to specific destination). And the log files support the documentation
HTH
Cheers
↧