The first order of business should be the volatile data or collecting the RAM. 

ADF has simplified the process and will expeditiously and efficiently collect the volatile data first when you select the “Create RAM Dump” Menu item. Once the RAM collection is saved to the collection key and completed you can next go right to the scanning of the drives, partitions, or attached devices for relevant and actionable evidence. This will allow you to make critical on-scene decisions. ADF does not analyze memory dumps, please use your favorite memory tool.