Sudden activation of Duplicati-server.sqlite encryption

1

Hi,
I’m using Duplicati for years. I installed this software on Windows 10 (22H2) and it works quite well. I’m starting it as a Scheduled Task:
Trigger: at user logon
Action: C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe

Edit 2026-08-16 20:14: I forgot to write version of my Duplicati - it is 2.3.0.4_stable_2026-07-09

Last Thursday this task started to return ResultCode: 3762504530 and Duplicati didn’t start. I tried to start Duplicati manually and I got following error message:
The database appears to be encrypted, but no key was specified. Opening the database will likely fail. Use the environment variable SETTINGS_ENCRYPTION_KEY to specify the key.
Crash!
This message surprised me, because I don’t define SETTINGS_ENCRYPTION_KEY in any way (no preload.json file, no as environmental variable, no as command line arguments). I must admit, that I found in my Keepass db entry titled “Password for Duplicati-server.sqlite”, but when I tried to run:
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe --settings-encryption-key=KEY_FOUND_IN_KEEPASS

I got such message:
Unhandled exception. Duplicati.Library.Interface.SettingsEncryptionKeyMismatchException: The encryption key used to encrypt the target settings does not match the current key
I decided to rename Duplicati-server.sqlite to Duplicati-server.sqlite.OFF and create file preload.json with following content:
{
"env": {
"*": {
"SETTINGS_ENCRYPTION_KEY": "KEY_FOUND_IN_KEEPASS"
}
}
}
and start Duplicati once again using same command as in scheduled task. Duplicati started successfully but there wasn’t any backup jobs. Fortunately I have file with configuration of a backup job. I imported it successfully, but after import Duplicati show that number of version equals to 0 and Duplicati created following alert:
Found 66631 remote files that are not recorded in local storage. This can be caused by having two backups sharing a destination folder which is not supported. It can also be caused by restoring an old database. If you are certain that only one backup uses the folder and you have the most updated version of the database, you can use repair to delete the unknown files.
I decided to start db recreation process. (Now I think i was wrong decision - I still have old db of this backup job, I could point to it in job definition {Placement field}).
Process of db recreation took almost 24h! It finished successfully but with 4 warnings:
2026-08-13 23:50:16 +02 - [Warning-Duplicati.Library.Main.Operation.RecreateDatabaseHandler-MissingFileDetected]: Remote file referenced as duplicati-ba3fe53926f9d4307a54435116f5034a1.dblock.zip.aes by duplicati-i09b3a4197b3c4937aee203037ad7b58f.dindex.zip.aes, but not found in list, registering a missing remote file
2026-08-14 02:25:49 +02 - [Warning-Duplicati.Library.Main.Operation.RecreateDatabaseHandler-MissingFileDetected]: Remote file referenced as duplicati-bd8b969b64c72436eb437b6bef668205a.dblock.zip.aes by duplicati-i66842a6702eb4e16bdf52fe18123973e.dindex.zip.aes, but not found in list, registering a missing remote file
2026-08-14 08:30:52 +02 - [Warning-Duplicati.Library.Main.Database.LocalRecreateDatabase-MissingVolumesDetected]: Replaced blocks for 2 missing volumes; there are now 2 missing volumes
2026-08-14 22:09:21 +02 - [Warning-Duplicati.Library.Main.Database.LocalRecreateDatabase-MissingVolumesDetected]: Replaced blocks for 2 missing volumes; there are now 0 missing volumes
Just after db recreation process has finished, backup job started and it take more than 16h - most of the time job was in “Deleted unwanted files…” state (almost 17h):
Backup job start: 2026-08-14T21:30:20.2716246Z
Delete files stage start: 2026-08-14T21:39:34.7933444Z
Backup job end: 2026-08-15T14:16:36.0961209Z
I stopped the backup job manually and Duplicati reported that this job finished successfully. But next backup job took long time too (13h) and also most of the time took file deletion stage. This job was not manually closed and this job had 2 errors:
2026-08-16 08:38:44 +02 - [Error-Duplicati.Library.Main.Operation.BackupHandler-FatalError]: Fatal error\r\nHashMismatchException: Niezgodność skrótu w pliku "duplicati-ba1dc65445ee2492d949def10d87d0379.dblock.zip.aes", zarejestrowany skrót: gfgUbr8f+6UNCpaGS/D4hm+Jh+2tLRZy9d94tGJEEAg=, rzeczywisty skrót XLsqK79Uc05c4rCW5Ln9EB/ZkuisNoqmBoIslO6jWNE=
2026-08-16 08:38:57 +02 - [Error-Duplicati.Library.Main.Controller-FailedOperation]: The operation Backup has failed\r\nHashMismatchException: Niezgodność skrótu w pliku "duplicati-ba1dc65445ee2492d949def10d87d0379.dblock.zip.aes", zarejestrowany skrót: gfgUbr8f+6UNCpaGS/D4hm+Jh+2tLRZy9d94tGJEEAg=, rzeczywisty skrót XLsqK79Uc05c4rCW5Ln9EB/ZkuisNoqmBoIslO6jWNE=
I start Repair process - it took about 1 minute and generate 2 warnings:
2026-08-16 10:38:59 +02 - [Warning-Duplicati.Library.Main.Operation.RepairHandler-LargeEmptyIndexFile]: The empty index file duplicati-i09b3a4197b3c4937aee203037ad7b58f.dindex.zip.aes is larger than expected (39789 bytes), choosing not to delete it
2026-08-16 10:38:59 +02 - [Warning-Duplicati.Library.Main.Operation.RepairHandler-LargeEmptyIndexFile]: The empty index file duplicati-i66842a6702eb4e16bdf52fe18123973e.dindex.zip.aes is larger than expected (51725 bytes), choosing not to delete it

Now I have following questions:

  1. How can I resolve HashMismatchException errors?
  2. How can I resolve “The empty index file is larger than expected” warnings?
  3. How to import backup job when I have configuration file AND working job db?
  4. What key is used to encrypt when SETTINGS_ENCRYPTION_KEY parameter is not explicitly defined (in preload.json file or as environmental variable or through command line argument)?
  5. What could have happened that enabled the database encryption between last Wednesday and Thursday?
  6. Where exactly logs created by Duplicati are written?
  7. Why older logs of backup jobs are inaccessible when job is running?

Best regards
LukiD

2

These messages indicates that somehow the files were changed after being uploaded.
I recommend figuring out what happens, because if the files are changed, it will usually end up giving a bad surprise later when you want to restore.

If there is a good explanation (like you decided to re-compress the files manually or similar), you can activate the advanced option --skip-file-hash-checks, but don’t do that unless you know what changed the files and that this change is benign.

You can ignore that. If you really want it to go away, you first need to ensure the other issues are resolved. Once you have a clean backup, go and delete the reported index file, then run “repair” to get the file re-created in a good state.

You can just import the job, and then go and edit the database path from the UI to point to the existing database path.

Since this is on Windows, the default is to store the encryption key in Windows Credential Manager.

Most likely the database has been encrypted the whole time. This is default for 2.3+. If no encryption key is provided, Duplicati will create a random key and store it in Windows Credential Manager.

What I think has happened is that the key has been deleted.

I have heard that some “cleaner tools” have an option that will wipe Windows Credential Manager. If you run that, you loose the encryption key.

In Duplicati 2.3 there is a small logic issue when this happens.

  1. Duplicati starts, sees that the database needs encryption
  2. Figures no key is present, creates a new key, stores it
  3. Tries to open the database, fails due to wrong key

This does not break anything, but it means that you can look in WCM and verify that a key is indeed present, but unfortunately it is not the right key.
This has been fixed in the current beta release, so Duplicati checks if it needs an existing key before creating a useless one.

For the beta/canary builds there is now a “wipe-encryption” command in the Duplicati.CommandLine.DatabaseTool.exe / duplicati-database-tool, which can remove all encrypted fields from Duplicati-server.sqlite. Once this is done, Duplicati can start with the database and re-encrypt. You then need to manually edit the configuration to set up the missing values (encryption passphrases, connectionstring etc).

By default, Duplicati only writes logs into the different databases. You can use the bundled databasetool to view it, or any SQLite database browser (try SQLite Browser for instance).

You can start Duplicati with --log-file=<path> --log-file-log-level=verbose if you want a full log.

When the backup is running, Duplicati needs to write things to the database. Because of this it has a lock on the database that prevents you from accessing it.