How do I track file copying?

Technically-speaking, there isn't a formal "file copy" filesystem operation. Instead, a file copy operation involves opening the source file for reading, creating/opening the destination file for writing, reading from the source file, and writing to the destination file. You can track each operation separately and attempt to correlate them to track file copying. However, keep in mind that copying of data can also be done with some sort of "middle step", where the data is transformed in memory (compressed, encrypted, etc.) as it is copied.