I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
You could look through either the UserAssist registry entries for each user (located in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist), or check the prefetch files (located at
Both maintain a list of run programs on the machine including the last time they were run and the number of times said program was run.
Some times the lack of evidences is evidence in it self. If you find sectors with absolutely nothing in them, it is possible that the Cleaner Tools have been used. Almost all disks will have left over data in the unused sectors. You might be able to use this method to determine if large chunks of Data were removed.