I'm trying to determine if workstation was used to download/burn the Live CD.  

The only other thing that comes to mind is to search for text from the disc, maybe a ReadMe file and search for unique phrases across the exhibits. You might get lucky and find the the files within unallocated.  

That's a great idea, thanks.  

- digitalcoroner

I'm trying to determine if workstation was used to download/burn the Live CD.

The first thing that comes to mind is carving the hard drive for a disk image (shouldn't be much of a problem especially if you know exactly what size and format the CD image was in). In addition, you can carve pagefile.sys or volatile memory dump for some content from that Live CD.
_________________
Digital Evidence Extraction Software
belkasoft.com 

Do you mean manually carving? If yes, would you have an example on how to do this?  

If the machine was booted with a CD on a network (home or work), and it received its IP address dynamically, you could examine the DHCP log files on the server or home router. (Most boot CDs that I've used are set to automatically get their IP addresses from the network DHCP server.)

The give away that it was a boot CD would be finding an entry with the workstation MAC address, but a different Machine Name than the workstation normally has. You may even be able to tie the machine name to boot CD distro if you're lucky.  

Excellent tip, thank you!