I have the following security issue. A zipped archive of emails was found on a machine (A) by using an undelete program. The claim made by the subject of the investigation is that they made the archive on another machine (B) to transfer files TO A from B. Management suspects that the archive was made on A with a view to taking a copy off site.
Is there any way to prove that the archive was or was not created on A? This is XP Professional.