MS Access system - IP theft case, how to identify if stolen

Can someone point me to how to best go about proving that the system is a copy (or based on a copy)? !

Did you have a look at the MFT to check if the Access DB files where copied onto the already identified USB device? This might be enough to get a "Swedish Serach Warrant", having evidence of USB devices and a copy process together with a time stamp.

And far from any Forensics the data theft might have (ab)used the data and already sent advertisments (SPAM!) or printed letters to existing customers. This might be a piece of evidence, too.

best regards, Robin