Here ya go...
Response Number 1
Date: March 28, 2005 at 15:26:42 Pacific
Subject: Log in and out times...
You can check for the events in the "event viewer" section of "admin tools" in the control panel. There should be a note as to a "blank" user profile as to when they either started the system or changed the log on to a different user.
A different way to tell where someone was during a specific event could be seen within the hidden dat files, but only in regards to a cookie from a certain web site or even hidden url's. I use "spider 1.16" to clean these files and you can actually see them before they are clean.
Hope that helps you, setishock!!
I'm a member of another forum in which I posted your question. This is the responce I got. I too hope that is the answer you were looking for...