Hi Friends,
we had a scenario,in my friends company an employee(who is in high position) has copied some highly classified
files when leaving the company,we are trying to find some evidence for it.
so far we have tried this beautiful tool called USBDeview and we can see the usb device insertion history in the device.
but we are looking for file copy logs by the user.

the guy is not a techie and so we are thinking that the evidence might be still there in the machine.
the machine is a windows 7 laptop.they had an AV installed in it,but at the time of incident its license were expired and after that it was renewed.
AV used was quick heal.the machine was not formatted ,the machine is currently with us.
so we probably know when the incident has happened. we are looking for file copy logs to the usb on that specific time.

can some experienced white hat hackers guide me or give me some tips about how i can get those VITAL USB FILE COPY LOGS ?