VFC can be used to recreate the suspect's computer. I like that it doesn't interfere with the computer or my PC, but instead has all files copied somewhere else so can be viewed elsewhere. It requires some technical skills to install correctly. The trial version is not adequate for determining if you want to continue using. Give it a try before deciding.
We have been able to view logs on suspects computers without having them connected to their network. I like that it is easy to use, you don't