I have a situation in which a person has been accessing confidential information from another PC which they shouldn't have accessed and stored the acquired information on their own PC.
Since all of the computers are within my jurisdiction, I am the one responsible for any information leaks and, since I don't know whether that person is going to misuse the information, I could copy/clone/seize their hard drive to serve as a proof that they stole and had that info on their PC should they try to e.g. sell that info to competition.
What I'm interested in: if the information ends up in competition's hands, I will know for certain they did it but can I prove it by showing that the original drive was inside their PC? Are there traces that could link that hard drive to his PC e.g. motherboard/CPU configuration, user name etc. or would that be dismissed under argument that I could've written that info to the disk?