Volatile information locations such as files or the RAM change constantly, and data collection should occur in the order of volatility or lifetime of the data. Which should be collected first?
a. Routing tables, ARP cache, process tables, kernel statistics
b. Memory (RAM) CPU, cache, and register contents
c. Temporary file system/swap space
