Q1
Single choice
When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?