Suspected rootkit or keylogger installed while gone

I had to leave my computer alone for about 2 and a half hours last week and I suspect my close friend installed some type of rootkit or keylogger while I was gone as an April fools joke. I'm curious as to what I should do to verify that he actually hasn't done such a thing. I have run a malware and rootkit scan since I got back and nothing was detected. The only other thing I was going to try was tear apart my computer and see if any new hardware was added. My computer was moved from its original location when I got back and my exteal hard drive was unplugged on the drive (the USB cable was still plugged into the back of my computer). Any ideas? He told me that encrypting my hard drive isn't going to change anything and that's why I suspect a keylogger or something similar. Thanks!