[ds9]

Thank you! Found this so far: http://security.stackexchange.com/questions/7203/checking-if... - and it's not very encouraging. The answers there assume that the now-owner has access to a "clean" state of the machine to compare a later condition with - but the problem situation, and the reality for everyone today, is evaluating the condition when it's first received.