When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?
The network connections and open ports
The contents of physical memory
The current routing table
A list of the running services
Submit