which of the following should be captured based on memo…

When performing data acquisition on a workstation, which of the following should be captured based on memory volatility? (Select two.)

A.
USB-attached hard disk

B.
Swap/pagefile

C.
Mounted network storage

D.
ROM

E.
RAM