Computer forensics

Hi,

I have someone that is perfoming well as this person should not be acting at the work space and I have been tasked with doing some forensic testing on his machine. Any ideas out there as to what I can use to track his history?