drop Android Samsung Knox database files, log files, or getprop output · parse Knox workspace enrollment state · surface Knox warranty bit status · analyze Knox Vault and Keystore artifacts · detect Knox Secure Folder presence and content metadata · assess forensic implications of Knox security architecture · runs locally