A disgruntled user was caught copying some files from hard disk to pen drive. When someone saw him, he quickly forcefully deleted data from pen drive and hard disk. Computer is having Windows 10 installed in it. This has been reported to incident handling team, first responder came there to collect evidence from that running computer. The system might contain something crucial as an evidence in system like open files or some hidden files or some files on RAM. Write all tools and steps you will take to collect digital evidence from hard disk and pen drive. Please note that integrity of the data must be maintain. Log all hashes from start till end.