What did ROAR see?
1. Someone logging into a user account
2. Someone going across the network to a shared drive
3. Someone changing the names of the files and saving the files locally<
4. Someone opening their email client and emailing the files (with names changed) to a webmail address