Entries lost in particular date range

[ruleset]

I had some data loss happen. I wonder if anyone might have insight as to how my process led to the loss?
Has anyone seen a similar gap appear?
What methods might I try to recover the lost entries?

All keepassxc entries in "mydb" modified between 2024-03-25 and 2024-05-03 were gone upon opening a daily-use database. Entries with later and earlier mod times survive.

Dates of entries, sorted by Modified descending.
...
2024-05-05
2024-05-05
2024-05-04
2024-05-03
2024-03-25
2024-03-25
2024-03-21
...

Sequence of Events

I don't know how to reproduce the outcome, so I will describe what happened

• before:

  • the usual backup filename pair: mydb.kdbx and mydb.kdbx
  • the db lived on a removable drive that remains attached always
  • upgraded to 2.7.7 from 2.7.5. Kept old app, renamed KeePassXC-2-7-5-intel.app
  • had recently moved all entries into Root group. Workaround for "I'm not seeing all the entries, because some group was selected in hidden sidebar".

• between 3/25 and 5/03: there were many adds and edits of pre-existing entries.

• May 2 or 3

  • day: connected to a new wifi network
  • KeepassXC was running with dbs in tabs. the affected db may have been unlocked.
  • computer experienced total power failure. came unplugged, and battery failed.
  • 1 entry edited that night survived (the 5/3 bound)

• May 4

  • travel. connected to unsecured WIFI (i know!), with VPN/kill switch
  • open database
  • noticed the gap in entries
  • ensured that no search filters were active
  • examined mydb.old.kdbx and surrounding files. missing entries not found

• mitigation: changed backup filename scheme to {FILE}-{DATE}.kdbx

Expected Behavior

Expected the five weeks of entries to persist, or
that backup mydb.old.kdbx would contain some of the missing entries or
that loss would be "to date" (March 25 - current) or
that loss would be total.

Actual Behavior

A specific date range was lost.

Context

During the timeframe described, the browser extension was reconnected.
It had reported
KeePassXC-Browser has encountered an error:

Cannot connect to KeePassXC. Check that browser integration is enabled in KeePassXC settings.
Months earlier, browser integration was working.

KeePassXC - VERSION
Revision: REVISION

upgraded app debug info:

KeePassXC - Version 2.7.7
Revision: 68e2dd8

Qt 5.15.11
Debugging mode is disabled.

Operating system: macOS 11.7
CPU architecture: x86_64
Kernel: darwin 20.6.0

Enabled extensions:
- Auto-Type
- Browser Integration
- Passkeys
- SSH Agent
- KeeShare
- YubiKey
- Quick Unlock

Cryptographic libraries:
- Botan 3.1.1

debug info, prior version:

KeePassXC - Version 2.7.5
Revision: 9d0537b

Qt 5.15.8
Debugging mode is disabled.

Operating system: macOS 11.7
CPU architecture: x86_64
Kernel: darwin 20.6.0

Enabled extensions:
- Auto-Type
- Browser Integration
- SSH Agent
- KeeShare
- YubiKey
- Quick Unlock

Cryptographic libraries:
- Botan 2.19.3

Operating System: macOS

[fellipec]

I just notice the same thing happening here. Here is what happened that led me to discover this problem:

• Yesterday (May 25) I created a couple new entries in the database, saved it, synced with OneDrive to another computer, used on the other computer, used on my cell phone, that entry was there.
• Later I reorganized the same entries in a new folder, saved the file. Didn't test it again after this.
• Today (May 26) that folder was gone with the entries inside.
• Tried to open the file with the original KeePass to check the history of entries and noticed everything between Nov 11, 2023 and yesterday were gone:

• Went to my backups (that run a couple of times per day) and found one just after I added the first entry Yesterday, May 25. The history is correct on this one:

I have no idea what triggered this, but the fact is a lot of data was lost. I'm using KeePassXC version 2.7.8

KeePassXC - Versão 2.7.8
Revisão: f6757d3

Qt 5.15.11
Modo de debug desativado.

Sistema operacional: Windows 11 Version 2009
Arquitetura da CPU: x86_64
Kernel: winnt 10.0.22621

Extensões habilitadas:
- Auto-Digitar
- Integração com o Navegador
- Chaves de Acesso
- Agente SSH
- KeeShare
- YubiKey
- Desbloqueio rápido

Bibliotecas de criptografia:
- Botan 3.1.1

After reading @ruleset 's report more carefully, I noticed he also moved entries from folders. Perhaps this somehow corrupts the database.

[droidmonkey]

It certainly doesn't, you must have jumbled your files like he did. Note his issue he opened, then closed, when he realized his mistake: #10776

[fellipec]

Of course, user error is always a possibility, just I can't fathom where I could jumble those files, checked every copy of my automatic backup and even OneDrive file versions. Also, unlike him, I use just one file and usually don't touch the backup copies, and KeepassXC always open the same file by itself.

Anyway, now I learn I could use {TIME} in the automatic backup setting so if this happens again I'll have a precise history of saves to refer to. I'm glad for your quickly answer.

[droidmonkey]

Based on what you wrote it sounded like you manually copy the file into your onedrive for syncing, is that true? If so you could have accidently overwrote that with your phone's copy other computer's copy. Data loss doesn't happen to arbitrary entries or groups, everything is written systematically to the database file. If that were not true then everyone would be having data loss.

[fellipec]

No, I don't manually copy anything, the file lives in OneDrive.
But your answer prompted me to investigate more related to my phone. Although the history of the main file in Onedrive had only few entries and all looked almost the same, the history of the file.old.kdbx was way longer (why onedrive, why?) and I could pinpoint a moment in time where the filesize decreased:

Perhaps KeepassDX or the Onedrive or something had an old version in cache and used it. This is the only plausible explanation I can think about. Although KeepassDX have the flag "read only" set... Perhaps some quirk with Android's one drive client, I'll have to review this setup to ensure the phone never can write on the main copy of the database. Again, thanks so much for helping.

[droidmonkey]

I usually do "reload data" in KeePassDX top right menu after unlocking the database to make sure everything is gtg.