Thanks for all your help...
If there is a way to conclusively prove that 'something' happened, that would at least be enough... because during that set window of time 'nothing' should have happened at all. Even if I can't see exactly what procedures were performed... just knowing that the CPU...