We have a potential internal investigation whereby somebody is accused of watching inappropriate videos in works time. They suspect the videos were on either a USB pen drive, or on the users phone which was then attached to their windows 7 enterprise laptop. Would there be any obvious places to look for evidence to support if they did indeed watch such material? If so, can any pointers be provided? or is it a case of if the videos themselves were not saved locally on the laptop (i.e. were only ever on the USB drive and/or phone), there will be no real pointers of such activity taking place. I assume there wouldnt be an actual copy of the actual video played via USB/Phone stored locally on the machine itself?