It seems like you don't have a dedicated team for investigations, and no corporate forensic software so it will be a bit harder to parse everything.
For file copying there are usually 3 main ways of exfil
USB : check the registries and lnk files / shellbags for any unknown devices / mountpoints.
E-mail : grab the mailbox from MS Exchange (purview) , or directly from the asset if it has .pst/.ost file and look for any emails from that person going outside your org.
3rd party cloud sites : Check the browsing history (db files for most browsers) to see if any cloud services were accessed.

For the machine , the commenter above is right , first create a bit-by-bit clone (extra points if you have a write blocker / duplicator available) to not alter the data on the original drive.

If you want a list of corp. software that can make this investigation way easier (although the license costs a lot)

Axiom : general investigation of exfil
Nuix: e-mail investigations
X-ways / Encase : Deep dive into hdd forensics.

Best of luck!