Scott, Puppy,

What may be better than cutting off the internet access is to keylog these sessions for a while, to get a history.