As for us, every hard copy is numbered and tracked - has to be turned in at end of day OR inventoried and stored in a container. Two people have to verify container contents before locking so no way to lie about that.without collusion.
Hopefully the idiot found a computer with an active USB port and put it on a stick. That'll be the easiest way to track down the perp.