Re keychain, you're probably aware of it, but https://github.com/ptoomey3/Keychain-Dumper/ is very thorough in extracting keychain data (including data that one would expect to no longer be in there).