I wrote:

> Have you checked for the possibility that the PC was using
> a virtualization or sandbox environment?

Windows SteadyState is another one to watch for:
http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx

"At intervals you designate, Windows SteadyState deletes the
contents of the cache and restores the system to the state in
which disk protection was first turned on."

--
Geoff Worboys
Telesis Computing