[Report] Anatomy of a Mobile Data Depletion Incident: What the Evidence Actually Shows

A defensive breakdown of how three independent evidence streams — carrier usage logs, package burn history, and Wi-Fi auto-join records — can converge to indicate suspected device or network compromise.