Does creating an archive prove data was exfiltrated?¶

No. Archive creation can be staging, backup, packaging or migration. It proves neither that the archive contained the suspected data nor that it was transferred.

Preserve the archive operation¶

Retain the path, creation time, creator account and process, command, working directory, included files, size, compression and encryption. The visible name may be misleading, and the archive may be partial, corrupt or empty.

If deleted, filesystem, command and security records may preserve its former path, size and file list. Deletion may support concealment but still does not prove transfer.

Connect staging to movement¶

Look for later reads, cloud uploads, network transfers or removable-media copies that reference the archive. A linked destination event creates the evidential bridge from preparation to possible exfiltration.

Absence of an archive does not exclude transfer: files can move individually or through application APIs. Encryption affects content identification but does not itself prove malicious purpose or successful movement.