First look for evidence on the hard drive.

Also read this thread. https://bitcointalk.org/index.php?topic=91702.msg1016998#msg1016998