Preserve quietly, then confront
Once a departing employee knows an investigation has started, the useful artefacts start disappearing. Image the devices, suspend mailbox purges and capture the cloud storage and access logs first.
Suspending automatic deletion policies across the relevant accounts takes minutes and prevents an argument about spoliation later.
Look for movement, not content
The early questions are about behaviour: what was copied, when, to where, and how it differs from normal working patterns. That comes from artefacts such as USB connection records, download logs, printing history and sync clients, not from reading documents.
Match the evidence to the relief you want
Springboard relief, delivery up and an injunction each need different proof. Decide what you are asking the court for in the first days, because it changes which artefacts are worth the analysis budget.