Often the data isn't exfiltrated at all, only encrypted in place, which should be relatively easy to prove.