Detecting theft of data - folder / files transfered from MacBook to USB
TL;DR: With a standard install of macOS it isn't possible to determine with any certainty whether data has been copied from the Mac onto an USB or network device



This is one of those questions where it's "a duplicate but not a duplicate because the answer doesn't work for me."

Here's a quick summary that addresses your question of whether or not you can detect if someone copied your files (to a USB):


You don't actually know if the file was copied. The problem with the answer from the linked question (and what makes this not a dupe) is that it only tells you if the file was accessed, not if it was copied to another location.  To elaborate, if the person double clicked on the file and closed it it would show it was accessed.  This is why you can't have your "100% certainty" (or even 50% certainty) as you state.
The logs don't record this activity.  There will be nothing in the logs because even if you look through all the system logs, it will only show that a USB device was attached/detached.  It doesn't tell you what was done with that USB device.


To do this and to have proof positive that this activity occurred, you need to enable Auditing and this is accomplished with OpenBSM.  Understand, it's not turned on by default because it would generate tons of log entries using up system resources as it monitors activities. From a system resource perspective, auditing is an "expensive" function to perform.

The problem with this and the linked question is that you're looking for an audit trail post hoc.  This is like wanting to have security camera footage of a break in when the security cameras weren't installed and operating prior to the breach.