drop f2fs partition image · parse node + segment + checkpoint structures · runs locally
magic 0xF2F52010 · superblock @ 1024 · NAT/FNODE/INODE node scan · checkpoint pack
heuristic screener · parses artifacts locally · not definitive proof