drop brave browser tor-window cache · parse private session remnants
flags tor window usage timestamps · onion navigation remnants · bridge refs · session storage keys
heuristic screener · parses artifacts locally · no password cracking or live network · leveldb binaries may need pre-export · not definitive proof