When performing data acquisition on a workstation, which of the following should be captured based on memory volatility? (Choose two.)

{} [+]