Microsoft has written the Fundamental Computer Investigation Guide for Windows. If you have suspicions and need more data - but you are not yet ready to call in someone for a complete forensic investigation - this guide will help you to investigate further using forensic principles. Using forensic principles will preserve evidence for civil or criminal court procedures in the event that those become necessary. You can read it as a Web page here.