Can an expert examining hard drive tell if a downloaded program was actually used or applied?
This of course all depends on the program. But usually when a program is installed or run it will install new files and directories to the computer as well as make changes. Someone knowing what they are looking for could easily notice these changes.
If a popup comes up, you click on it, can it automatically download a program without the user knowing it?
No. However, if you receive an Active X Windows warning Popup (not the standard browser popup window) then it could install a program.
If an expert examines your hard driver, is it possible to tell which were popups and which were actual websites you visited and spent time on?
Again depends on the site. But when a page is downloaded the popup source code is also downloaded examining this code someone could identify between a popup and a visited page.
Is it possible for someone examining your hard drive to add and/or detele information on that hard drive, even changing dates and times?
Yes that is all completely possible.
