Identify data theft via USB memory stick?

I have an associate who owns a smallish business with an equally smallish network.

A problem has arisen in that a member of his staff has "lost" some important and sensitive data from their networked PC.

We have analysed the hard drive & that of the shared Server and "recovered" deleted or otherwise "lost" files which appears to have worked inasmuch that we obtained data which had been deleted over a considerable period of time before and after the "lost" data was created, yet there is no sign whatsoever of the lost data.

There is a suspicion (but only a suspicion) that this particular staff member just might have saved these files to a USB stick, rather than the hard drive or Server and I am wondering if (and if so, how difficult is it) evidence can be obtained which would show the date and time a USB drive has been employed and (even better) whether such might detail the contents (or at least the filenames and types) of data that was saved in this way?

Would Windows event viewer reveal any or all of this and how would we go about isolating USB drive activity etc., through this means, if so?

Any advice, please? :)