Your organization has onboarded 500 Windows 11 devices to Microsoft Purview Endpoint DLP. A compliance analyst reports that a user may have copied files containing credit card numbers to a personal cloud storage service last week. The analyst needs to review the full sequence of that user's file activities on their device — including copy-to-USB, upload-to-cloud, and print events — to build a timeline of what happened, even for actions that did not trigger any DLP policy alert. Which Microsoft Purview tool should the analyst use?