An investigator wants to collect the most volatile data first in an incident to preserve the data that runs the
highest risk of being lost. After memory, which of the following BEST represents the remaining order of volatility
that the investigator should follow?

A.
File system information, swap files, network processes, system processes and raw disk blocks.

B.
Raw disk blocks, network processes, system processes, swap files and file system information.

C.
System processes, network processes, file system information, swap files and raw disk blocks.

D.
Raw disk blocks, swap files, network processes, system processes, and file system information.