For a FIM search, on the With mask, configure to search ALL FILES

We will need a little more context for the request meaning the mask field in only one field in the create inclusion.

First, you need a path for every drive c:\,d:\, etc

Next depth contain in all files recursive mean subdirectory as well

Lastly for the type of action read/write/create/delete.

Please note the read field on the open mask with generation to many entries to be useful and will hammer your server.  so target the drive and folder to be more specific.  

There is no way to determine if someone copied a file unless you have the agent installed on both server and client. 

I hope this helped.

We will need a little more context for the request meaning the mask field in only one field in the create inclusion.

First, you need a path for every drive c:\,d:\, etc

Next depth contain in all files recursive mean subdirectory as well

Lastly for the type of action read/write/create/delete.

Please note the read field on the open mask with generation to many entries to be useful and will hammer your server.  so target the drive and folder to be more specific.  

There is no way to determine if someone copied a file unless you have the agent installed on both server and client. 

I hope this helped.