S-RM Interview Question

How to identify exfiltration (windows forensics)