Thanks for the tip, Gargoyle. Unfortunately, Sherlock checks only for "created" or "modified", not "accessed", and it doesn't check cookies. So unless the miscreant downloaded a file with a giveaway name, this approach doesn't ferret out what we're looking for. Any other suggestions?