Booting from a USB forensic toolkit would be useful
Not legally admissible, or at least very much unlikely to be so without a great deal of hard work and supporting evidence.
Booting from USB doesn't prevent you writing to the hard drive, does it !
A decent IT department will block USB boot anyway.
As I said, he shouldn't play detective unless he knows what he's doing. Let events play their course and follow normal procedures (employment tribunal etc) if he feels aggrieved. Leave Sherlock Holmes to those with experience.