During an investigation of a compromised Windows 11 workstation in Microsoft Defender for Endpoint, you need to preserve a broad forensic snapshot of the device (autoruns, installed programs, network connections, scheduled tasks, and prefetch files) for offline analysis by your incident response team. The device is currently isolated. Which single Defender for Endpoint response action captures this collection in one downloadable archive?