why do you look in the bios for a hooked process?

In which of the following locations would a forensic analyst look to find a hooked process?