CISA Web TestEngine demo

Make an image of the hard drive for investigation and save the original drive in a secure place.

Investigate the original hard drive to ensure it has not been tampered with.

Ask the user of the endpoint to make a copy of the hard drive and provide it to the auditor for investigation.

Shut down the computer in order to preserve the evidence, disconnect it from the network, and restart.