drop tresorit desktop client data · parse encrypted vault metadata · runs locally
flags device pairing · share link metadata · policy bypass attempts · off-hours · actor spikes · bulk destructive
heuristic client data parse · tresorit layout varies by version · encrypted vault content not decrypted · best-effort metadata only · not definitive proof