TL;DR: A method to examine a filesystem and determine if and when files were copied from it is presented, by stochastically modeling filesystem behavior under both routine activity and copying and identifying emergent patterns in MAC timestamps unique to copying.