In the latter case, step 326 may be implemented only to check for system activity indicating the presence of the user, while step 332 may be implemented to further check for system activity indicating remote access to the system, such as hard drive or network adapter activity.