drop registry export and browser history csv · detect dns over https enabled in browsers and system · identify periods where dns was encrypted and invisible to standard logging · surface doh-caused dns log gaps · runs locally
drop registry export and browser history csv · local only
heuristic screener · vendor schema varies · not definitive proof