Unable to recover KDBX file Topic is solved

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bwilts
Posts: 2
Joined: 12 Jan 2021, 15:12

Unable to recover KDBX file

#1 Post by bwilts »

Hi,

last week I deleted my kdbx file unfortunately.

Unfortunately Photorec is not able to find any kdbx file.

Any idea how to proceed?
Windows 10

Thanks,

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Unable to recover KDBX file

#2 Post by recuperation »

You will have to build a fingerprint:

viewtopic.php?p=32663#p32663

You find information on the net about kdbx files.

bwilts
Posts: 2
Joined: 12 Jan 2021, 15:12

Re: Unable to recover KDBX file

#3 Post by bwilts »

But kdb and kdbx files are already recognized from Photorec, when I chose file options.

So it's no use?

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Unable to recover KDBX file

#4 Post by recuperation »

bwilts wrote: 12 Jan 2021, 15:14 Unfortunately Photorec is not able to find any kdbx file.
I did not bother checking Photorec for you, I understood your phrase as if there is no support.
Communication is difficult!

Anyway, Photorec supports kdbx files in their latest version.


The following is not a primary source but contains some information about their file headers:
https://gist.github.com/lgg/e6ccc6e212d ... c116fb1e45

Your left with the option to
1. build a custom fingerprint file.
2. Patch the Photorec executable accordingly
3. recompile Photorec with a modified fingerprint, replacing 0x67 with 0x66 or 0x65

Locked