Just a couple thoughts. Any activity performed while the Live-CD is running will not be logged or tracked by the installed OS (since it isn't running). The system logs will give time and date of reboots that are required to bring up the Live-CD. The gap in the logs will give you how long the system was under the Live-CD boot, which can then be co-related to other logs, video records, swipe cards, etc.

The theft of the calendar and appointments for the purpose of setting up an abduction works so long as the theft hasn't been discovered. If an attempt was made and thwarted, and the logic (main character) asks just how could they have arranged this at this time? Only with access to the appointment calendar! Trigger investigation.

However, once foiled, the same type of attempt would be foolish and unbelievable on a second try, and only pursued by stupid (Hollywood) bad guys. Smart bad guys know they will be found out. However, there is other information in the Outlook files that can be used (journaling, if it hasn't been turned off, will point to documents and activities), Tasks can have deadlines and pretty extensive notes, and some appointments include contact information for friends and associates. These can be used by smart bad dudes to wrangle intended victims into corners.

Yes, you managed to get some of the more generous and helpful of the AO'ers on this topic. It is fun, though.