If that's what he means, then all the more reason to think he wouldn't
yet be in a position to unilaterally ascertain what was accessed and sent. If there are no outgoing emails in his sent or deleted box, no outgoing Google Voice SMS messages, no Google Drive sharing or link creation events, etc., then the only way he'd be in a position to "confirm" much of anything this early on would be going into settings for device access logs to the extent visible to the user, which seems uncertain to reveal much considering that the depicted KF browsing activity for pages back in July suggests an exfiltration around that time, long before expiration of the retention period for logs visible to the user referenced ITT variously at
28 days or
30 days.