drop iOS logs plists or Android logcat and locksettings database · detect passcode change events · surface credential type changes · identify passcode change bursts · assess complexity weakening · runs locally
optional acquisition anchor for pre-examination urgency
drop iOS logs · plists · Android logcat · locksettings.db