By default Win7 (and Vista) don't update the Last Accessed date/time stamp when one views a picture or opens a file.

How else could one determine if a picture was opened (let's presume it's not in the recent files listing)?  

.lnk files, registry MRU's immediately come to mind.

Depending on what software you are using you may be able to recover deleted copies of the picture that were previously in different locations (may indicate copy/paste type behaviour showing they were at the very least dealt with in some manner)  

Thanks, Adam. I see that the MRU listings are numeric. What software would you suggest to search the Registry for the file names?

The lnk files work oddly. It appears as though there's a limit to how long or how many of them stick around in the Recent folder. Plus, I just tested opening some jpg files with Windows Explorer and no lnk files were created.  

- JimGill

How else could one determine if a picture was opened (let's presume it's not in the recent files listing)?

As mentioned, LNK files are a possibility.

Jump Lists are a pretty big one.

*Where* the data appears can depend a great deal on how the image was viewed...with which application. Like I said, Jump Lists are a big one, and new to Win7, and specific to both the user and the application (via the AppId).

One of the things that generally doesn't help to say is "the MRU keys", because there are many.

Do you know the extension of the image file in question? How about the graphics viewers on the system? Any indication of the file name beneath the ComDlg32 key in the user's hive?  

Internet History is a good one as well.  

- keydet89

Jump Lists are a pretty big one.

To reiterate: I would check the file extension in the registry and determine the default viewing program, then using Mark Woan's jumplister have a look if a jumplist for that appid exists.

If the file isnt in that jumplist (or the jumplist doesnt exist) then I'd start exploring other appid's  

I normally look at the file access history stored within the user area 'ntuser.dat' file - some refer to it as the internet history.

also look at thumbcache db files within the folders that the images might have been stored in, if there are thumbnails in the folders then it could be argued that the images were viewed in windows explorer 'image view'.

As others have said MRU, LNK files are worth looking at.