In a situation where data is to be recovered from an attacker’s location, which of the following are the FIRST
things to capture? (Select TWO).

A.
Removable media

B.
Passwords written on scrap paper

C.
Snapshots of data on the monitor

D.
Documents on the printer

E.
Volatile system memory

F.
System hard drive