Data written to removable storage logging with continue action

In the application and device control policy, one of the policies is created to allow users to read and write to the removable storage devices, my configuration is to "continue processing with other rules on each of removable device listed, the policy works pretty well to give the users rights to write to the removable storage devices, however, from the log, it is difficult for me to figure out whether the users is just to read the file from device, or it is action that the user has copied or write the data to the removable storage device. for the logging, I will need to have the log clearly and accurately tell me which file is copied or write to the removalbe storage device, how do I achieve it?