drop tor browser profile dir · parse state + places.sqlite + key3.db remnants
flags bridge usage refs · onion history remnants · disabled security settings · extension sideloads
heuristic screener · parses artifacts locally · no password cracking or live network · key3/key4 binaries may yield string remnants only · not definitive proof