S-RM interview question

How to identify exfiltration (windows forensics)