using the client and the matching encryption key (there is a 'catalog shell' command with a CLI browser, and a 'mount' command that mounts the archive via FUSE so you can use your favourite tools to browse and access its contents). both don't download the full backup, but load those chunks which are currently needed on-demand.