A suspect computer is still powered on and may contain active chat sessions. What should be collected first?

A. Volatile data such as RAM and active network connections B. Only printed documents C. Only archived backups D. Only device packaging