Which one of the following is not a first response procedure?

Preserving volatile data (like RAM contents, active network connections, running processes) is a critical first response step because such data is lost once a system is shut down or powered off.

Filling out forms, such as chain of custody logs and evidence intake forms, is an essential first response procedure to accurately document the handling and state of evidence from the outset.

Cracking passwords is a time-consuming and resource-intensive activity that occurs much later in the forensic investigation process, typically during the analysis phase, and is not a first response procedure.

Taking photos of the scene and system is a standard first response procedure to visually document the physical condition and context of the evidence before it is moved or altered.