5 btc lost? KeePassX issue? Reward for help with recovery.

[URSAY]

I am missing the pw for my blockchain.info account with over 5 btc.  Originally the login info was input into KeePassX on 1/17 or 1/18.  The KeePassX file in question says it was last moified on 12/21 according to my OS.  However, this file shows an entry saved from 1/23 (after the shown modified date and after the missing KeePassX entry).  Is there a log file which might give me more info on the KeePassX file in question?  I had not yet backed up the KeePassX file with issues unfortunately.  The pw was likely generated by KeePassX and is 30-35 characters.

The file was open on 1/21 when my computer unexpectedly lost power.  I'm suspecting this could have a part in the corruption of the KeePassX file which should contain the missing data?

Finally, I'm not expecting to be able to recover these coins which would mean they could be lost forever.  Is there a website or database which logs these "lost" addresses/coins to which I can add any information?

[ncognito13]

Check out this article

http://www.antoine-cervoise.fr/2013/02/12/bruteforce-a-keepass-file/?lang=en

[jantenner81]

damn it! Sry to hear and good luck for recovery! Sry can't help you on this issue, had smae with kexpassx month before!
After this i found a workaround to autosave keypassX after each change!

http://superuser.com/questions/381554/save-data-after-adding-new-entry

http://www.mydigitallife.info/how-to-auto-save-the-database-in-keepass-password-safe/

Sry man, its a pity, but hope it can help you to avoid those kind of losses in future.

Cheers
jan

[keithers]

Any chance you can use Time Machine and roll back your computer to before you had the problem?

[URSAY]

Any chance you can use Time Machine and roll back your computer to before you had the problem?

I don't use Time Machine.

Auto save wouldn't have helped as these entries were saved at one point.  It's also not a matter of brute force as I have the master pw to the file.

The biggest frustration is not knowing what happened.  I'm now discovering other entries in my KeePassX file which are missing altogether.  Yet, some very recent entries are still available regardless of the earlier modified file date.

I should of never had that much btc in my hot wallet.   

[Justin00]

probs to late anyways.. but have you tried to do a database repair ?? tools -- database repair. i think in newer versions of keepas you start a new db and import the corrupted one and it starts to repair cause it doesnt have the tools/repair option.   
save what ever you got now before hand, if you do it.

and does blockchain.info passwd just let you into the site or unencrypt the wallet and let you in ?? can the admin of blockchain do anything magic tricks ??  I know the point of blockchain is that they cant.. but maybe if you both edit.. err stuff.. ??

[URSAY]

probs to late anyways.. but have you tried to do a database repair ?? tools -- database repair. i think in newer versions of keepas you start a new db and import the corrupted one and it starts to repair cause it doesnt have the tools/repair option.   
save what ever you got now before hand, if you do it.

and does blockchain.info passwd just let you into the site or unencrypt the wallet and let you in ?? can the admin of blockchain do anything magic tricks ??  I know the point of blockchain is that they cant.. but maybe if you both edit.. err stuff.. ??

When I try to import a copy of the database I get an error, "XML parsing error on line 1 column 1: error occurred while parsing element".  But I think KeePassX might be slightly different then other versions of KeePass out there.

I already tried speaking to a friend at Blockchain.  He's told me that without the pw there's not much I can do.

[keithers]

lMan that is so frustrating..I am sorry.  I hope you didn't have all of your BTC in that one wallet.  Is there anyone at KeepassX support that can try to help you?

[URSAY]

lMan that is so frustrating..I am sorry.  I hope you didn't have all of your BTC in that one wallet.  Is there anyone at KeepassX support that can try to help you?

The majority of my bitcoin is in cold storage and safe.  It could have been far worse.

I've tried posting on the KeePassX forums and sending them an email.  Unfortunately those forums are rarely visited or responded to it seems.

Thanks for your responses guys. 

[scribe]

Just to check, have you looked in the "Backup" group if you have one? My KeePassX certainly has one, but not exactly sure what it saves or how long for.

[Justin00]

ah sorry i didn't even notice the 'X'
had a quick look.. it's pretty much just keepas for linux yeah ??

anyways best of luck with it

[URSAY]

Just to check, have you looked in the "Backup" group if you have one? My KeePassX certainly has one, but not exactly sure what it saves or how long for.

Yup.  I've looked there but with no luck.  It's so strange that while the modified date says December '13 on the KeePassX file, some January '14 entries are still available in the file and others just disappeared with no trace.

[URSAY]

ah sorry i didn't even notice the 'X'
had a quick look.. it's pretty much just keepas for linux yeah ??

anyways best of luck with it

KeePassX runs on Mac OS X.  

[scribe]

Just to check, have you looked in the "Backup" group if you have one? My KeePassX certainly has one, but not exactly sure what it saves or how long for.

Yup.  I've looked there but with no luck.  It's so strange that while the modified date says December '13 on the KeePassX file, some January '14 entries are still available in the file and others just disappeared with no trace.

Yeah, the date stamp thing is odd. Is there any chance you opened the same file twice at the same time?  KeePassX locks the file and warns you if it's already open, but you *can* ignore the warning, at which point there's a risk only passwords from one of the open files get saved, and the other gets overwritten.

[URSAY]

Just to check, have you looked in the "Backup" group if you have one? My KeePassX certainly has one, but not exactly sure what it saves or how long for.

Yup.  I've looked there but with no luck.  It's so strange that while the modified date says December '13 on the KeePassX file, some January '14 entries are still available in the file and others just disappeared with no trace.

Yeah, the date stamp thing is odd. Is there any chance you opened the same file twice at the same time?  KeePassX locks the file and warns you if it's already open, but you *can* ignore the warning, at which point there's a risk only passwords from one of the open files get saved, and the other gets overwritten.

I know of at least 2 missing entries off the top of my head which were saved at a 2 very different times in Jan.  One was created and saved on 1/4 and then the missing bitcoin account entry was created on 1/17 or 1/18.  It's very likely I had created other entries and saved them during that time in-between which may or may not be missing.  So if I am understanding you, then I would of had to of made this mistake multiple times which I think is unlikely.