According to one site (http://strydehax.blogspot.com), one of the features of the software is it does NOT log what it's doing on the laptop being monitored. No only that, but it deletes the image files it captures after sending them back to home base. It's possible some of those files could be recovered even though they've been deleted, but it's going to require more than a casual inspection plus a little luck. It appears likely that the only way to know what was actually done is to obtain the logs from the IT servers--which of course are maintained by the very people in the best position to record images without authorization. The school system has been ordered by the judge not to delete any such logs, but that order came days after the lawsuit so if somebody was doing something illicit and those logs still exist, then that somebody is an idiot on top of everything else.