The only kind of trace available on Windows is the Windows Event, which could be accessed from the Windows Event Viewer, as shown below:
![enter image description here](../../I/static/images/3a394262b2d58683bb3388b0047cf2f4b8e8eeda86d9d44ca30e92b846040491.png)
Unfortunately, I couldn't find (I suspect that anyone would) any specific event related with your problem (unauthorized file copies to flash drives).
I am almost sure that you will not be able to find if someone already did an unauthorized file copy from your system, but I could list two applications that would help to find if someone try the same thing in future:
DiskMon is an application that logs and displays all hard disk
activity on a Windows system. You can also minimize DiskMon to your
system tray where it acts as a disk light, presenting a green icon
when there is disk-read activity and a red icon when there is
disk-write activity.
This is a behavioral analysis tool of applications for the Win32
operating system family. Capture BAT is able to monitor the state of a
system during the execution of applications and processing of
documents, which provides an analyst with insights on how the software
operates even if no source code is available. Capture BAT monitors
state changes on a low kernel level and can easily be used across
various Win32 operating system versions and configurations. CaptureBAT
is developed and maintained by Christian Seifert of the NZ Chapter.
Additionally, I would recommend you to use some kind of cryptography on your disk to protect your files from this kind of problem. Take a look on Truecrypt software.
Hope this information helps you some way.
1+1: By the way, interesting and useful question. – Diogo – 2012-05-17T11:40:40.080
1
possible duplicate of How to monitor and report file copy activities in windows XP?
– Moab – 2012-05-17T14:14:20.663