In the case of Google, retroactively by using detailed forensic logs.

Soon afterward, forensic engineers, led by the Google executive Gary Brown, began combing Project Chauffeur’s databases in search of material that could be used to block Uber’s acquisition of Ottomotto. They eventually discovered a small lead. According to Google, a month before Levandowski resigned, he had plugged his work-issued laptop into a Google server and downloaded about fourteen thousand files, including hardware schematics. He transferred the files to an external drive and then wiped his laptop clean.

https://www.newyorker.com/magazine/2018/10/22/did-uber-steal...