Why should cybercrime investigators always work with problematic data on a non-infected system and use an approved forensic toolkit? How do these things relate to volatile memory? Describe a specific tool that can be helpful when dealing with volatile data and/or memory and explain why this tool is helpful.