drop idrive backup log · parse backup + restore events · timeline + findings · runs locally
flags encryption password changes · cloud wipe commands · selective backup edits · off-hours · actor spikes · bulk destructive · first-seen admin
heuristic screener · client/export format varies by idrive version · column and line mapping is best-effort · parses artifacts locally · not definitive proof