Name the failing stage
| Symptom | First distinction |
|---|---|
| File cannot be read | Path, access, completeness and actual format |
| Password rejected | Wrong candidate versus wrong or damaged input |
| Wallet opens but will not sync | Local keys versus historical network behavior |
| Restored wallet looks empty | Wallet type, derivation, address range and history |
File-level failures
Compare the byte size and fingerprint of the working copy with the preserved original. Record whether the copy came from an active wallet directory, a rolling snapshot or an encrypted archive. A parser for one family may reject another correctly. Keep any error text, but remove personal paths and sensitive values before sharing it publicly.
Decryption is not the whole test
EncryptedFileReaderWriter tries a current IV-prefixed layout and contains a legacy fixed-IV fallback controlled by a validity check. Read that branching logic together with the concrete encrypted-file subclass. Merely obtaining output bytes is weaker evidence than successfully interpreting the expected wallet structure. This observation comes from source inspection; it is not a security audit.
Synchronization problems
A discontinued desktop wallet may fail to provide a usable current network experience. That does not by itself establish whether its local recovery material is intact. Preserve the files before attempting repairs, resets or reinstallation. Treat network troubleshooting separately from extracting or restoring the wallet’s private recovery information.
Apparently empty restoration
Revisit the original wallet family, seed interpretation, account path, receiving/change branches and discovery range. Compare a known historical address where possible. “Empty” is an observation about the current view; it is not a diagnosis. Record the settings that produced it so another reviewer can reproduce the result.
A reproducible incident note
Include the application version, operating system, evidence-copy identifier, exact action, exact error and whether the operation completed. Add what changed since the last successful access. Do not attach wallet words or private keys. This lets an investigator separate environmental issues from format and credential questions.