// per-tool methodology

mobile location services disable artifact detector

drop powerlog knowledgeC routined cache logcat · location off timeline · visit gaps · pre-acquisition disable · runs locally

public grade

flagship triageraw 13/14 · raw 12–14 / 14

Astructuredflagship triage

capability class: Sstructured
subcategory: mobile anti-forensics
what to expect: trust as a first-pass tool · still verify before any legal use

real parser depth · 2+ exports with reason fields · honest limits · canonical UI shell

binary databases and plist/registry hives — SQLite, plist, lnk, registry text, logcat

max grade for this class: A

WAL/journal sidecars and partial copies may omit recent rows
encrypted or locked stores require keys or decrypted images not supplied by this tool

even A-grade tools can be wrong on rare inputs, malformed files, or adversarial samples
independent verification is required before consequential or evidentiary use
the grade is not a court-admissibility score — jurisdiction and chain of custody still apply

newly added forensics tools must clear the public B minimum before merging
minimum: letter grade B or A · raw score ≥ 9/14 · UI dimension = 2 · IF/OU/DQ/RB/HN ≥ 1 each · no critical red flags (missing engine, placeholder logic, no exports)
the ship bar is enforced by quality.audit.json sidecars and npm run tools:grade-forensics --check