When performing data acquisition on a workstation, which of the following should be captured based on memory volatility? (Select TWO).

A USB-attached hard disk is non-volatile storage that retains data without power, so it is not prioritized based on memory volatility and can be acquired at a later stage in the forensic process.

The swap/pagefile is a virtual memory extension on disk where the OS pages out RAM contents, making it highly volatile in context-it reflects recent memory activity and can contain decrypted data, process information, and artifacts that mirror RAM contents and would be overwritten or lost as system activity changes.

Mounted network storage is non-volatile and resides on a remote server, meaning it is not subject to local memory volatility concerns and persists independently of the workstation's power state.

ROM (Read-Only Memory) is by definition non-volatile and permanently retains its contents regardless of power state, making it the least volatile storage type and not a priority in volatility-based acquisition.

RAM (Random Access Memory) is the most volatile storage on a system, losing all contents immediately upon power loss; it contains running processes, encryption keys, network connections, and other forensically valuable artifacts that cannot be recovered after shutdown.