Reply #5: Not if the person doing it was smart

[deadmessengers]

If you start with physical access to a powered-off unattended computer, it's basically untraceable. It works something like this:

1) Open the case of the PC
2) Remove the hard drive
3) Place the hard drive into another machine
4) Using the second computer, make a an "image" of that hard drive - basically, a forensically-sound copy containing everything on the drive.
5) Replace the hard drive into the original machine.
6) Examine the copied image at your leisure.

Most mass-market desktop PCs do not have case-intrusion sensors, and nothing would ever be logged.