BIOS and hooked processes

In which of the following locations would a forensic analyst look to find a hooked process?