Best places are to check his :
Recent folder which shows folders and programs he opened before
Recycle bin to see if he deleted his hacks or w.e
CA folder to see any modified or hacking files
Internet history/Internet downloads to see what websites and Programs he downloaded.