The txt file was named "BC-13.txt" and when i look the details it shows ... that it was created 11.2013 on his PC.
I also check for BitcoinCore or another software that was installed maybe finding some crumbs of bad deinstallation,
but he has never uninstall something, and has only the standard programs and office pack on the pc.

I will try to switch the first and last characters now.