My theory is that they know exactly what he took, bitwise. It's just shitty work looking through 500GB of shitty power point presentations to try to figure out which one he's going to use next and how to respond to that... It's not an exact science here. So they know the information he has, they just don't know how it, or which of it, will be used. Also, He probably just has .ppt/.doc/.xls program level kinda files, it's not like he siphoned of the data under super duper lock and key that is on completely separate systems with completely separate auditing practices. (Ie all the data they actually have collected on you, etc..)