Windows Prefetch data is a great source of evidence to help determine file use and knowledge of applications running on the system.