Creating scripts to track XCM transactions in and out of Parallel Finance

A bunch of people need to figure out how much they had left on Parallel Finance prior to the hack. While the Parallel Finance history was destroyed by a Polkadot referendum, there should still be a record of transfers in and out to other chains through XCM. So, you can at least get an approximation of losses.

This should allow the new owners to verify the amount they owe to investors for the hack, and move on. There’s also the added benefit of potentially tracking down and identifying who hacked Parallel, and then pursuing the appropriate course of action.

So, what part of the XCM API would I need to develop a solution that can identify these transactions using Polkadot JS?

I found this and this other documentation. Is that what I need to identify XCM deposits into other chains?

To test this conceptually, I want to find transactions with balances.deposit set to null since Parallel deleted their history and balances.transfer populated? Or is the balances.deposit still going to reference Parallel, despite Parallel clearing their internal history?