if it is in a network, it might have sent requests for an IP to some dhcp-server, but else it doesn't log to anywhere.

If the user mounts harddisks, perhaps it could be mentioned by some fsck-activities, but I wouldn't know how to search for them.

close the computer away - I would suggest, or use an cryptic filesystem for secret data.