In a situation where data is to be recovered from an attacker's location, which of the following are the FIRST things to capture? (Select TWO).

Removable media is non-volatile storage that retains data without power and can be collected safely after more volatile evidence is secured.

Passwords written on paper are stable physical artifacts that will not change or disappear due to system state changes, so they are lower priority than volatile digital evidence.

Data visible on the monitor reflects the current live system state and can change instantly if the suspect interacts with the system, making an immediate screenshot or photograph critical before any other action is taken.

Documents on the printer are stable physical items that can be collected after volatile digital evidence without risk of data loss.

Volatile system memory (RAM) contains ephemeral forensic artifacts such as running processes, active network connections, decryption keys, and session data that are permanently destroyed when the system is powered off, placing it at the top of the order-of-volatility capture sequence.

The system hard drive is non-volatile persistent storage and is imaged after volatile memory and on-screen data per the standard order of volatility.