First thing you do is set up detailed logging of all actions of staff, particularly in regard to deleting files, emails, etc. or modifying documents.

Then you tell them all they are fired, as of close of business next Friday, and watch as they rush to delete all the incriminating data. But, you have it all backed up and are logging their activity.