CS0-003 Web TestEngine demo

Shut down the endpoint first and document the evidence after analysis.

Capture volatile data first; record method, hashes, times, and custody.

Copy selected files without hashes because no court proceeding is planned.

Reimage the endpoint and use the change ticket as the evidence record.