When investigating a network that uses DHCP to assign IP addresses, where would you look to
determine which system (MAC address) had a specific IP address at a specific time?

You are called by an author who is writing a book and he wants to know how long the copyright for
his book will last after he has the book published?

How many sectors will a 125 KB file use in a FAT32 file system?

When performing a forensics analysis, what device is used to prevent the system from recording
data on an evidence disk?

You have been asked to investigate the possibility of computer fraud in the finance department of
a company. It is suspected that a staff member has been committing finance fraud by printing
cheques that have not been authorizeD. You have exhaustively searched all data files on a bitmap
image of the target computer, but have found no evidence. You suspect the files may not have
been saveD. What should you examine next in this case?

In a FAT32 system, a 123 KB file will use how many sectors?

Under which Federal Statutes does FBI investigate for computer crimes involving e-mail scams
and mail fraud?

What TCP/UDP port does the toolkit program netstat use?

Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or
unique identifier, of the machine that created the document. What is that code called?

Which federal computer crime law specifically refers to fraud and related activity in connection with
access devices like routers?