[GDH]

Yes, there are ways to determine this information. However it is not an easy or simple process. You need to engage a computer forensics examiner to investigate the system.

Prior to doing this the most important thing is not to use the computer as you will be changing the contents of the drive and will make the task much more difficult. The first thing a Computer Forensics examiner will do is to take a forensic image of the disk (an exact copy) to preserve the evidence that is on the disk. He/She will then work on this forensic image.