Well now I could just say I was running tar and saw "resume" fly across the screen.

Or maybe because she had a problem I was in her directory and saw a suspicious file.

More than likely I was doing recon - I'm curious, so anything is possible.