Wow. After reading that testimony it doesn't look in the least bit conclusive that he copied any files at all.
Information omitted that make the testimony one that is obviously presented to do maximum damage:
0) Did Levandowsky have more than one laptop? The testimony cites a laptop he was issue for several months but connected to Google's network only three times over those months he had it. Since he worked at the company during the time, I think it is reasonable to assume that he had more than one laptop and this was one that was issued and never really used.
1) Since this laptop was never really used, it's reasonable that it would get out of date. It's possible that it was used infrequently enough that changes in security policies in the Google autoupdate software would cease to work because it missed a critical security update were a full-reinstall was the simplest path to resolution, especially for a laptop that wasn't well used with data and settings worth preserving. I've seen this situation first hand at prior employers. It especially happens when a critical security update doesn't get applied in time.
2) Was the SVN repository in question one that Levandowsky had a legitimate business need to access? Had he previously accessed that repository on a different laptop that he used more regularly?
3) How many people involved in Google's self driving car program had access to this particular repository? What percent of the self driving engineers does this represent?
4) A Transcend RDF5 card reader was attached to the laptop 3 DAYS AFTER the repository was downloaded. No mention was made about a card inserted into the reader. Was any physical volume ever mounted through the card reader. If so, what kind of physical volume was mounted and how big was it? Was it large enough to store all 9.7 GB of data in the repository? Are there any logs that show files were copied from the laptop to a storage volume, assuming one was ever attached.
5) Was this card reader ever attached to any other device owned by Google that Anthony had access to? Assuming he did attach a storage volume and assuming he did copy files, is it possible that he was just moving files from this device to another one he used? Was this possibility investigated?
6) Five files were exported to his Google Drive on one occasion and another later. The later copied file, a "weekly update", is hardly the type of file that would suggest wrongdoing for anyone whose seen the typical "weekly updates" teams at big companies write. The contents may be sensitive, but they are typically high level and contain few if any details that allow reproducibility. How were those six files accessed later and from what other devices? What's in those files and why are they sensitive/important? How can each file enable a competitor?
There are too many missing dots in that testimony to actually take it seriously, especially since it's been written to maximally insinuate wrongdoing for all three engineers listed.
After reading this testimony, my opinion is that this is absurd and should be dismissed. It's entirely too circumstantial and the forensic "expert" hardly investigated and answered questions that highly relevant to interpreting Levandowsky's actions.