drop iOS TCC database unified logs or Android runtime-permissions.xml and logcat · detect permission revocation bursts · flag camera microphone location revocations · surface pre-acquisition evidence gaps · runs locally
optional acquisition anchor · TCC service decode: 34 services
drop TCC.db · runtime-permissions.xml · logcat · unified log