Three backup families
The original help distinguishes rolling, local and cloud backups. Rolling backups are encrypted snapshots of the current wallet. Local and cloud backups package a broader wallet directory into an encrypted ZIP archive. Cloud describes the destination of a copy, not an entirely separate wallet format. A synchronized folder may contain an encrypted archive rather than the primary wallet file.
A practical comparison
| Evidence | Interpretation | Next check |
|---|---|---|
| mbhd.wallet.aes | Primary encrypted wallet | Wallet family and password-based decryption |
| rolling-backup/*.wallet.aes | Timestamped wallet snapshots | Compare intact copies and dates |
| zip-backup/*.zip.aes | Encrypted directory archive | Backup key / wallet-words route |
The encryption distinction
The historical documentation describes rolling backups as password-encrypted, while software-wallet ZIP backups use a key derived from wallet words. EncryptedFileReaderWriter also has separate methods for ordinary password encryption and backup-key encryption. This is why a tool that understands an encrypted primary wallet must not automatically be assumed to understand a ZIP backup.
What an archive can preserve
The restore help explains that backups can retain information beyond the keys and blockchain-visible history, including contacts and notes. A phrase-based reconstruction and an archive restoration therefore do not necessarily produce the same application metadata. Decide whether your goal is access to the wallet, preservation of historical notes, or both, and keep copies accordingly.
Read filenames as evidence, not proof
BackupManager recognizes timestamped names and directory conventions. A match identifies a candidate for further inspection; a filename can be changed independently of the bytes. Preserve the original name when making a working copy and record any name change. Do not remove .aes and expect an encrypted ZIP file to become a valid unencrypted archive.
Avoid a destructive cleanup
Backup rotation code can prune old entries during normal operation. For investigation, retain all available snapshots before starting an old application. Compare copies outside the original directory. If a later snapshot is damaged, an earlier one may still contain useful material; deleting near-duplicates before understanding them removes that option.