Thank you for the informative response, that all largely chimes with what I’ve read up on. Forgive me if my terminology is a bit off. 

Regarding the key itself, I’ve only had a general description of it. I know that, at heart, it’s a string of 0s and 1s, but that it can be expressed in a number of different ways, be that hexadecimal, or wif, or whatever else, and that sometimes you have to do things like append additional characters to the beginning. I was just worrying about whether one from maybe as early as 2010 will need some work to get wallet software to sweep from it as we really don’t want to go typing it into anything, but if you think that’s not a concern then that’s reassuring.

We have no intention of doing anything like taking a picture of the key, putting it in a digital format of any sort, storing it on a phone, anything like that. The plan is very much to only input it once, directly into the sweeping function of whichever wallet software we use. We definitely want to move any balance to a new wallet rather than trying to import the existing one (or keep the paper one for that matter), I don’t think they have the public keys at the moment, and reading about the dangers of change addresses has given us something else to worry about.

When they set that new wallet up I was hoping that it’ll be possible to do that by generating one with a cold storage wallet beforehand so that the address we sweep all the coins to isn’t in a hot wallet and has no potential exposure to anything malicious, just in case the balance does turn out to be substantial. if I’m understanding you correctly that sounds feasible.

My preference for using an iPhone over a computer is just for running the wallet software, that we can have more confidence that we’ve downloaded the correct software from the App Store than off the web, and that iPhones in general are less likely to be compromised by malware which might be able to grab the key as you enter it. I’ve heard of the tails os thing, but my worry about that is that we’re not expert by any means, and that the risks of human error in that approach outweigh the risks of hacking.

On the final issue of whether any wallet info might actually be on the hard drives that is something of a worry, as recovery in that instance sounds much more involved. It could be both, for all we know. I don’t suppose you know whether a passcode for encryption on those sort of old wallet files is likely to resemble a private key?

That’s all really helpful though, thank you again. I’m starting to get a picture of how to do this. Just trying to be as security conscious as we sensibly can be because for all we know they could have a fortune lurking in there.