drop victim device backup · run safety-focused triage (different priorities than suspect) · runs locally
device backup · safety triage · local only
heuristic screener · vendor schema varies · not definitive proof