Question 49:
When performing data acquisition on a workstation, which of the following should be captured based on memory volatility? (Choose two.)
Answer options:
A. USB-attached hard disk B. Swap/pagefile C. Mounted network storage D. ROM E. RAM
Answer correct:
BE