If you have regular backups of your system, it'll be easy to find any temporary files left over by Mathematica by comparing directory listings pre- and post-incident.
On Windows, if you're using a backup system that can mount the backup images as volumes - e.g. Macrium Reflect - you can get the directory listing of the temporary folder:
% on the backup image volume, let's say it's D:
cd d:\Users\%username%\
dir d: /s /b sortorder:N > %userprofile%\temp_pre.txt
% same on the main volume, say it's C:
cd %userprofile%
dir c: /s /b sortorder:N > %userprofile%\temp_post.txt
Then you can use your favorite file differentiating tool to compare the two files and see if you can spot anything useful. SmartSynchronize is "free-to-use" (and otherwise well worth the money), and cross platform, so you can use that to inspect a user-friendly difference of the two directory listings.
Of course, you could do all that in Wolfram language as well.