ivi sqlite heuristic · ios plist · android bt_config · CoD + OUI · connection timeline · primary/passenger role · csv/json export · runs locally
Device names like "John's iPhone" paired at 11:47 PM — together with MAC addresses and timestamps — are routinely introduced in criminal proceedings. Preserve exact spelling, possessives, and timezone context in investigator notes; do not normalize away human-readable labels.
heuristic IVI sqlite string scan · role classification is frequency-based · corroborate with toll/phone records