Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
Data was collected on this host and sent out.
Collect first, these expire. The NTFS change journal is what records the archive that was built and then deleted, and it rolls by size. On a busy volume that window is hours, not days.
SRUM byte counts alone. SRUM tells you how much a process sent, never where, pairing it with network or proxy logs is what turns a volume into a destination.
if you find nothing
Staging archives are routinely built and deleted. The USN journal records both after the file is gone, which is why it outranks looking for the archive itself.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
