Built into Snow Leopard and Leopard is the ability to connect to another Mac via Screen Sharing or VNC (Virtual Network Computer). One way to make this happen is by using the Finder. A user can simply choose "Connect to Server" in the 'Go' menu and type in the address of the Mac to connect to using the VNC address. Let's use an example of a Macbook Pro on my local network. The Macbook Pro is known as "macbookpro.local" on my test network. To connect to it, I would use the command: vnc://macbookpro.local
As an Apple Examiner, we want to know about the evidence of someone doing this. Take a look in the user's Home folder. ~/Library/Application Support/Screen Sharing to be specific.
User's Home folder Screen Sharing Evidence - 'vncloc' file
Notice the file that exists in this location. Thsi file is created as soon as the Screen Sharing connection is established. The contents of the file can be seen in the next image.
Contents of 'vncloc' file
The file is actually a simple PLIST with the address used for the Screen Sharing connection.
This folder will become populated with additional 'vncloc' files as additional VNC connections are made thru the Finder. If other apps are used, such as the popular Chicken of the VNC, you must look for other evidence.