Agreed - the goal isn't "the KB's prove you are guilty". It's metadata which serves as a means to reduce the number of computers you need to examine with a more complex/manual search (deleted files, temporary/corrupted files, word document history, interviewing the employee, comparing the material in the document with the role/responsibilities of the employee, etc).

I think you're forgetting that he could just re-print the file once he had located which printer it was on to verify. Once verified it's the file in question, you could easily check which device sent it to the printer.