digtial forensics

Digital Forensics

You receive word that one of your full time field employees is only working 20 hours a week. The rest of the time he is stealing company time by attending college in the afternoon at a nearby university.  He attends classes while sitting home via the online study course.  As part of his duties, he is given a company owned laptop.  He has falsified his field visits to trick his supervisor that he is actually working. This activity has been ongoing for over two years and you believe it’s worth about $50,000 in company losses.

Questions:
What Can You Do? How would you prove it from a forensics point of view?