You've got everything right. The last step (the one you are referring to) is done by brute force. The wallets just try out many many possibilities until they think they've guessed all the derived privKeys that you actually used. For each possible privKey, the wallet calculates the address and checks whether this address exists on the blockchain ( = there are or were coins on this address).
If you use the same wallet for recovering that also created all the addresses, then the derivation process is obviously the same and the wallet knows exactly how to derive the privKeys, to be sure to "guess" all of them.
There are also standards for how to derive the privKeys: