Which of the following tasks DOES NOT come under the investigation phase of a cybercrime forensics investigation case?

An investigator is analyzing a checkpoint firewall log and comes across symbols. What type of log is he looking at?

One technique for hiding information is to change the file extension from the correct one to the one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to verify that a file has the correct extension?

It takes _____________ mismanaged case/s to ruin your professional reputation as a computer forensics examiner?

Sectors in hard disks typically contain how many bytes?