KBDX wasn't autosaving. Very valuable data lost. Seeking ideas.

Help
John
2013-11-26
2013-11-27
  • John
    John
    2013-11-26

    My chrome history indicates that I downloaded KeePass 2.24 on November 5th.

    On November 21st, I encrypted 3 files with 3 different passwords generated by KeePass. 20 characters upper/lowercase and numbers.

    Today, I went to open those files, and couldn't find the passwords.

    It looks like the kbdx file hasn't been modified since November 1st. I keep my kbdx in a dropbox folder. No versions newer than November 1.

    I also backup my files using backblaze. There's a kbdx file modified on November 1st, and a kbdx.tmp file from November 15th, but nothing newer.

    I don't remember seeing any warning to save the database since upgrading KeePass.

    This is actually quite a devastating loss to me.

    Are there any options that I may not have considered?

     
  • Paul
    Paul
    2013-11-26

    KeePass does not auto-save the database after you change things, but it does warn you about unsaved changes when you close KeePass. If you close KeePass by shutting down Windows then it is easy to miss the notification.
    There are options to save the database on save / close, but it is really up to you to save after making a change.

    cheers, Paul

     
  • steelej
    steelej
    2013-11-26

    You said that you used KeePass to create passwords that were used to encrypt files. Could .

    What software did you use to encrypt the file?

    How did you create the individual encryption keys for each file with KeyPass?

    How did you copy this key to your encryption software?

    Did you create individual entries for each of these in KeyPass? Note that if you did then this should cause KeyPass to prompt you to save the database file.

     
  • John
    John
    2013-11-27

    Thanks for your responses and questions.

    Did you create individual entries for each of these in KeyPass? Note that if you did then this should cause KeyPass to prompt you to save the database file.

    I did, but I do not see these prompts. Now that I look, I see that the save icon changes color when there are unsaved changes. I recognize that I have a hand in this error, and am only looking to see if there are possible solutions.

    How did you create the individual encryption keys for each file with KeyPass?

    I opened KeePass and hit ctrl+i to create a new entry. I created a name for that entry in the 'Title' field. I clicked the button to to reveal the password created by KeePass, and entered it into the encryption software. Then I clicked OK, or hit enter to close the entry. At that point, the entry was visible in the Entry View.

    I realize now that I just had to hit ctrl+s, and everything would be OK, but I didn't.

    I have friends who are computer forensics professionals searching for versions of the files prior to encryption, as well as for records of these passwords. Is it possible that they might still exist on the disk in .kbdx.tmp files?

     
    Last edit: John 2013-11-27
  • Paul
    Paul
    2013-11-27

    KeePass doesn't write working data to disk, it's all stored in memory until you save or lock the database. The tmp files are likely to be "file transaction" files, not old data.

    cheers, Paul