What is the name of the "local user" account involved in the alleged actions (Hint: where in the file structure did you find the suspect files)? What was the IP address of the alleged offender workstation?

I will assume this is a windows computer

Explanation:

The windows user folder has folders that contain each users data, Using the file path of the suspicious file you can figure out which user is associated with the file.

Windows Security Logs collect data on logon attempts so when the user logs in their IP address should be collected in these log files.

1. the seasons of the world