Watch this video on YouTube
After initiating containment measures on a compromised computer, the cybersecurity team is now delving into investigative actions. What's the MOST appropriate subsequent action to undertake?