Is it possible to detect a user copying files?

This is a tough problem. The computer certainly knows that a user is reading files from the disk into the computer's RAM. Unfortunately, once the data is in RAM, it can't be tracked any further. It might be inside of Microsoft Word and displayed as a document on the screen, it might have been loaded into an FTP application and sent out onto the network, or it might have been loaded into a program that is sending it to the printer. It's just not possible to track the destination of a file once it's been read.

With the Ultra version of PA File Sight you can be alerted anytime a user reads more than X amount of data (a number of files, or an amount of data) in Y amount of time. For example, it's unlikely that a user would open and read 50 Word documents in a one minute period of time. So if 50 Word documents are read by a single user within 1 minute, you have a pretty good guess that a directory copy just took place.