....with some not-so-standard dependencies like plistlib that you would need to check ....containing magic numbers, their own timestamp conversion for some reas

....with some not-so-standard dependencies like plistlib that you would need to check ....containing magic numbers, their own timestamp conversion for some reason, classic obscure cryptographer variable names (A = R[0] etc), use of pack and unpack, which reads and decrypts various random files, writes tempfiles[1] and does other things that are not completely straightforward for even someone who knows what they're doing to fully assess. I mean it looks probably fine to me. But saying it's a 300 line python script is kind of begging the question. [1] using mkstemp but you need to check that stuff to make sure. You also need to check what it does with the things it AES decrypts (they're just pathnames so again, probably fine etc).