I think someone's been watching too much TV!

Could someone really copy the contents of a hard drive without depositing some malware on the machine first? Does it really happen that way anywhere else except TV?

If you were rifling the content of the drive, wouldn't you make sure NOT to lock the files and hence reveal your presence?

I'm with Blitzen (your time of year, eh?). In the absence of some serious piece of malware, it's more likely a OS problem.