Unfortunately, it isn't quite that simple. Modern PCs have a great deal going on inside of them even when they are "idle," so it's very difficult to tell what has been done with the PC over a specific, short period of time. No record of mouse activity, keyboard input, or disk activity is kept beyond the simplest statistics, and the disk drive is regularly used for both reads and writes even on a completely idle system.
I disagree, the swap file, the area used for temporary storage will have 100's of writes a minute when the notebook is in use, the writes will tell me the files open and for how long. This compared with the few writes an hour if any, when the notebook is in suspend mode. It's like chalk and cheese, any programmer would be able to see within minutes. If you have admin rights then anyone could check with user manager.
When you close the lid on your notebook, then reopen it later, it's in the exact same place of the letter you were writing, it has to store that info somewhere.
The fact that the pilots are expected to be honest and tell the investigators what exactly they were doing on their notebooks, would be easy to confirm by checking the hard drive, unless they deliberately cleaned their notebooks, but then it would be easy to see they had done so.