The most likely file to check would be the installation log - this will be called frminst_<name_of_machine>.log. This records agent installations, along with the mfeagent.msi log, should tell you when it was installed.
You can also use this file to deduce if it was a manual install or not: it's not infallible but it's usually fairly accurate:
A push install will usually be invoked from the directory specified in the system TEMP variable, usually Windows\Temp.
An install done as part of a deployment task will be invoked from a folder underneath the existing agent folder structure, usually ..\common framework\current\epoagent3000.
A manual install will normally be invoked from somewhere else
Thank you, Joe. I will take a look