Investigating a compromised system on-premises