If the FileShare server itself was compromised one could mount it in a way that wouldn't show leakage, or just image the thing and bork the original. Otherwise

If the FileShare server itself was compromised one could mount it in a way that wouldn't show leakage, or just image the thing and bork the original. Otherwise you could have a crawler that just traverses the FileShare and makes duplicates at a rate slower than what would look like BAU traffic. Given that most enterprise network shares host a TON of legitimate batch dump/upload file traffic it might be easy to skate by.