Uh, wouldn't they want the MAC address of the access cards in the machines? IP's change, MAC addresses don't, unless you use software to make them appear otherwise.
They asked for everything imaginable in there. But the bit they're looking to note in particular is "There was unbelievably high internet usage that day ... was this to county computers?!?"
(Answer: No, and it wasn't state computers either. But we don't know for sure).
My guess is that they'll do precisely what you're thinking: Re-flash all the ethernet with new MAC addresses (which can change them) and reconfigure the IP addressing. "We weren't destroying evidence, this is just regular maintenance!" sorts of shenanigans.
Uh, wouldn't they want the MAC address of the access cards in the machines? IP's change, MAC addresses don't, unless you use software to make them appear otherwise.
They asked for everything imaginable in there. But the bit they're looking to note in particular is "There was unbelievably high internet usage that day ... was this to county computers?!?"
(Answer: No, and it wasn't state computers either. But we don't know for sure).
My guess is that they'll do precisely what you're thinking: Re-flash all the ethernet with new MAC addresses (which can change them) and reconfigure the IP addressing. "We weren't destroying evidence, this is just regular maintenance!" sorts of shenanigans.