jdouthit;
first thing is to tell them to STOP using the box - to keep from overwriting the file info, which "probably" will NOT be retreivable - that said However - there are ways to view activity and see which Files were "viewed" and /or "downloaded" and saved. This is all highly dependent upon OS ver, but moreso the IE version, and Cache and Advanced tab settings in IE and Documents, History folders. Also whether or not certain apps (built in or otherwise) are set up to clean the caches. What I mean is - I have one of my boxes set to clear all caches (Run, Documents, Open, Find, etc)..some thru TweakUI and some other ways. Then there's always the M$s internal spyware to explore - to find out what it's archiving "behind your back".
So - Firstly - if it won't kill them to Stop using the box till you can get there and search...tell them to stop.
Post back with some more info if possible
IE version?
Power Users? (set up to delete caches?)
Does it seem the person who copied would have "viewed" the files first before transfer?
AFAIK - there's not really a way to just find out what you ask in that context, unless some software was set up previous to copying, to catch and record this type of info.
Is the box Networked?
Were the copied files on the Network?
TT4U
Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs