Investigation

Look through registry, ntuser.dat, link files, shell bags, etc