drop prefetch shimcache dns cache or browser history csv · detect tor browser execution and tor network artifacts · identify onion domain access and tor relay connections · surface anonymized communication evidence · runs locally
drop prefetch shimcache dns cache or browser history csv · local only
heuristic screener · vendor schema varies · not definitive proof