Track USB Drive File Copying After Employee Termination

For Dr Lee Gold office (Soho Dental) - he wants to know if there is anyway to track if someone copied contents to a usb drive on a few PC's. I know this isn't really possible unless some logging or software is setup before hand but are there any other suggestions/options available in this case? They had fired an employee and that employee deleted a document she wasn't supposed to - he wants to know if that ex employee might've copied over some data to a USB drive

I think the most you might be able to do (I could be wrong also, never really tried it) is if an USB was connected to the pc, there might be an event somewhere, but I doubt that beyond that, you would be able to track anything else D:

Windows doesn't keeps logs of moved/changed files, for that you'd need ```Enable Audit Policy: Open Group Policy Management (gpmc.msc) on the server. Create a new GPO (Group Policy Object) or edit an existing one. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access. Enable Audit File System (Success/Failure). Configure Auditing on Files/Folders: Right-click on the folder you want to audit. Go to Properties > Security > Advanced. Click on the Auditing tab and then click Add. Select a principal (e.g., Everyone or specific users/groups). Choose the permissions to audit, such as Create files / write data, Delete, Move, etc. Apply the settings. Review the Event Logs: After configuring auditing, check the Event Viewer under: Windows Logs > Security Look for events with Event ID 4663, which is logged when an object (file/folder) is accessed or modified``` It's pain in the ass to setup... There are third-party solutions like: https://www.isdecisions.com/products/fileaudit/ ~ Take to consideration it will fill up the space quickly and needs to be setup on every workstation ( Unless cloud ) 3. Antiviruses can have policy to access/deny external drives