Which of the following is the most fragile and should be captured first in a forensics investigation?

a. ARP cache

b. Kernel statistics

c. CPU cache

d. RAM