Does creating an archive prove data was exfiltrated?¶
The practical answer¶
No. Creating an archive does not prove that the data was transferred outside the environment.
The key evidential caution¶
The dangerous assumption is that compression and exfiltration are the same event.
Archives are created legitimately for:
Key points¶
- backup
- sharing
- software packaging
- storage
- migration
- administration
An offender may create an archive to reduce size, combine many files, conceal filenames or prepare data for transfer.
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the archive file
- path and name
- creation time
- creator account and process
- included files
- compression or encryption settings
- password or key evidence where lawfully available
- later access, copying or transfer
The archive may be incomplete, corrupt or empty.
It may also have been created automatically by legitimate software.
Evidential limits¶
Do not assume that a deleted archive never existed. File-system and security records may preserve traces.
Likewise, the absence of an archive does not exclude exfiltration. Files may be transferred individually or through an application API.
The evidential chain is stronger where archive creation is followed by a network upload, removable-media copy or cloud-storage event.
Archive naming may be misleading. An offender may use ordinary project names, temporary extensions or hidden locations. Preserve the command, working directory and file list rather than relying on the visible archive name. Where encryption was used, that may affect later content identification but does not prove transfer.
If the archive was deleted, preserve process, command and file-system evidence showing its former path, size and contents. Deletion after creation may support concealment but still does not prove that transfer occurred.
Operational takeaway¶
Treat archive creation as possible staging, and prove transfer and destination separately before describing the data as exfiltrated.