According to NIST SP800-86, which action describes volatile data collection?