Realm database parsing (scripts/realm_parser.py) adapted from crush/parsers/realm_parser.py in crush-forensics by Marco Neumann (kalink0). Licensed under Apache-2.0. Vendored with the framework-specific imports replaced by local shims and a parse_realm_file() entry point added; the upstream copyright and SPDX header are preserved in the file.

Preferences options setting ui Icon by Yaicon on Icon-Icons.com. Licensed under Creative Commons Attribution 4.0 International.

cpbitmap conversion logic adapted from cpbitmap-to-png by Harold Thetiot. Licensed under MIT.

Apple ATX container and decode details adapted from atx_reader by galba-arueira. Licensed under MIT or Apache-2.0.

Apple Unified Log .tracev3 parsing provided by the unifiedlog_iterator binary from macos-UnifiedLogs by Mandiant. Licensed under Apache-2.0. Redistributed unmodified in builds that include it; see bin/PROVENANCE.md.