drop suspect device backup · run multi-source triage + priority artifact surface · runs locally
device backup · triage export · local only
heuristic screener · vendor schema varies · not definitive proof