There are a lot of possibilities when it comes to this.... first though, since more and more programs are becoming "intelligent", a whole lot of them remember recent files used, so are you looking for a specific MRU (such as for internet explorer, or for the "run" option on the start button)?
Two major solutions are
Pretty Easy:
Just boot the system normally (naturally, if you are concerned that there may be some kind of fail-safe in place or self-destruct code, use the more complicated method, but if you are fairly certain that the system is safe, then you could download something like an MRUViewer [ http://www.aftermath.net/~coma/daniweb/mruviewer.zip ]) which allows you to see the IE History, cookies, cache, along with the run MRU.
Complicated:
If you are afraid that the PC which has been taken is equipped to clean up it's mess, or to "self-destruct" when you boot it, then you might want to take this approach.
Assuming that the NTFS drive isn't encrypted, you could boot the PC with a secondary OS from a liveCD (something like Knoppix , PHLAK , or STD ). With this in mind, you'll need to be a little bit comfortable using a Unix System, in which you would mount the NTFS hard-drive, and copy the registry files to a portable device, like a floppy, or thumb drive....
If you give me a bit more detail on what you are looking at specifically, I'm sure I could help you further your search....
