According to NIST SP800-86, which action describes volatile data collection?

Data collected during a system reboot would already be in the process of being lost from volatile memory, making collection unreliable and incomplete.

The presence of malware in data is a characteristic of the data's content, not a definition of volatility - volatile data may or may not contain malware.

Volatile data - such as RAM contents, active network connections, running processes, and decrypted data - exists only in live system memory. NIST SP800-86 requires this data be collected before a reboot or shutdown because the act of rebooting destroys it permanently, making pre-reboot collection the defining characteristic of volatile data acquisition.

After a system reboot, volatile memory is cleared and the original volatile data is gone, making post-reboot collection impossible for that volatile evidence.