How do I find out what was accessed on my computer while it was confiscated?

Solution 1:

If they did it the forensically correct way, then there is NO WAY to determine what was examined. The correct way would have been for the forensic tech to pull the hard drive out, clone it, return your hard drive to the machine and then examine the clone image. There will be no traces whatsoever on your drive since it was never booted. They will work strictly from the clone image and you should consider everything on the hard drive as having been compromised and you also should be aware they may have retained the image or parts of the image. Hope you didn't have anything on there you will regret.

Solution 2:

You can use a script to recursively sort files on the system by last access time. However, with all of the activity constantly going on in the file system such as indexing, it is near impossible to determine exactly what they've looked at.