My guess is he still had a network connection up when he did the copy. These kind of things like JAMF, osquery and so on upload what you do on your computer on a fairly frequent basis. After a certain company size all of them do something like this, and most of them do not spell out the amount of spying they do on their employee's work devices and office space.

Or he didn't do a secure wipe when he reformatted the drive and google inspected the computer when he returned it.

OR google modifies their laptops and has separate chips logging this stuff, which would be fairly impressive!

Or he didn't actually do any of this alledged stuff and it's all innocent.

We will find out in the court case either way!

I would imagine there are IDS systems running, given Google's state level adversaries.

Accessing large amounts of files you haven't previously accessed and shortly thereafter attaching an external drive should trip a competent IDS.

Unless it's changed since the last time I played with it osquery doesn't upload anything on its own–it's just a local tool/agent that you can use to gather data. Carbon black is a good example of something like that.

JAMF I believe gathers application usage data but nothing as in depth as what's being discussed. It's also comically handicapped. It somehow manages to do a poor job of everything it tries to do so "the world's largest online Mac administrator community" is forum post after forum post of half understood franken-scripts. I used to think it was milquetoast but after sitting through their sales reps crapping all over open source software (despite extensive use of OSS libs in their products) and seeing it fail to do the most basic stuff out of the box my opinion is that it's over priced crap.

Or, you know, syslog.

It could well be that they have comprehensive debugging enabled for all their employees on work supplied machines. I know they beta test through employees, so that would make sense, to some degree. If the debug log is remotely synced, as an added benefit they get to review actions after the fact, which might be what happened here.

Company-issued laptop probably tracks what software is installed anyway to mitigate malware. Services are probably designed not to accept connections from untrusted devices. Hardware 2FA makes it difficult to impersonate someone without their knowledge.

I can see the temptation—I've always missed having access to IP after leaving a company.

You cant restore SSDs. I would assume Googlers are rolling SATA SSDs, if not M.2 PCIE ones.

What Google could be doing is remote logging on the laptops - logs uploaded to ze cloud every time you connect to the mothership. Plugging in USB drive leaves trace with USB ID, volume information etc. Windows also logs this and more http://www.forensicswiki.org/wiki/USB_History_Viewing

Protip: to exfiltrate data with minimal trace your best bet is taking out the drive and reading it in another computer (using write blocker for best effect), this can still be traced if someone is logging SMART written/read data (I am, but Im paranoid), not all HDD/SSD vendors provide this info. Second best is booting from USB drive so the original OS never sees the plug/unplug event in the first place, I have no idea about current state of UEFI/AMT logging going on tho.

Disclaimer: I used to do forensics.

Really interesting! It's sobering to think about the ways that even in a system not set up for logging you can trace back through these actions.

I was asked to figure out what had happened on a system where some data had changed and 2 parties were blaming each other. After about a hour digging around I managed to piece together a picture of how Person X had got up on a Monday morning, discovered (on their mobile, home wifi) that they had made a mistake on Friday, then logged in on their desktop to fix it from home (first time they logged in at home), then went to work and blamed someone else.

What was remarkable was how many different sources there were to pick up bits and pieces from. In isolation there wasn't much to go on, but once you start the connecting the parts, it's really incriminating.