for indices from 0 to the next to last matching index
  if this index does not belong to a keeper
    skip the chaff data-HMAC blocks
  else
       read the data bytes
       use the (revealed) package key to decrypt this block
       if this is not the last (padding) data block
          write out the plaintext
       else
          write out the number of bytes indicated by the last byte
       end
       skip the HMAC
    end
end

Example 3: Second pass through the encrypted file.