Hi there Binary Bobby...............I was waiting for you

Now why would you want to do that if your intentions were honourable, and in accordance with the AUP of this site? That isn't forensics, or data recovery even..........that sounds like hacking to me?

Please explain the situation and your intentions..................

@BB
As the user still uses that computer sometimes, it is necessary that it is not seen until it is known to the user.


Very true, but I don't think that the OP can afford the alternatives or even the learning curve required.......... and that is notwithstanding evidence acceptability requirements?

I just suggested what I thought might be the best options for commonly available free stuff, given that my practical experiences have been almost exclusively simple disaster recovery situations.

A while back an acquaintance did give me a copy of that Microsoft "Coffee" (spelling could be different?) to evaluate for her............... I cannot say that I was that impressed..... have you ever seen it or have any thoughts?
What are the alternatives?