drop qubes os disk image · parse template + appvm artifacts
flags dispvm usage · networking policy overrides · template package drift · appvm/templatevm inventory
heuristic screener · parses qvm configs and xen logs locally · no password cracking or live network · not definitive proof