drop electrum wallet file · parse history + addresses · runs locally
parses addr_history · labels · txs · encrypted keystore metadata · lightning refs · no password crack
heuristic parsing only · wallet metadata and export text · encrypted keystores not decrypted · no password cracking or live network · not definitive proof