CaseKeeper Wiki

System requirements

Installing & silent deploy

The installer (CaseKeeper-Setup-v0.2.1.exe) is built with Inno Setup. By default it installs per-machine to C:\Program Files\DarkCipher0x Systems\CaseKeeper; users without admin rights can choose a per-user install from the elevation dialog.

# Silent per-machine install (run elevated)
CaseKeeper-Setup-v0.2.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART

# With a log file and a desktop shortcut
CaseKeeper-Setup-v0.2.1.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /TASKS="desktopicon" /LOG="%TEMP%\CaseKeeper-install.log"

# Custom install folder
CaseKeeper-Setup-v0.2.1.exe /VERYSILENT /SUPPRESSMSGBOXES /DIR="D:\Apps\CaseKeeper"

# Per-user install, no admin rights needed
CaseKeeper-Setup-v0.2.1.exe /VERYSILENT /SUPPRESSMSGBOXES /CURRENTUSER

The app doesn't auto-launch after a silent install (skipifsilent). If CaseKeeper is running during an upgrade, setup closes it automatically.

Upgrades & uninstall

• Run a newer installer over the old one — it recognises the existing install by AppId and upgrades in place.
• Upgrades never touch user data. Documents, notes, timeline, complaints and settings live outside the program folder.

# Silent uninstall (per-machine)
"%ProgramFiles%\DarkCipher0x Systems\CaseKeeper\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART

Data locations

Library placement

The library location is resolved in this order:

1. CASEKEEPER_LIBRARY environment variable, if set — useful to force the library onto an encrypted drive via policy.
2. The folder saved in library-location.json (set by Settings & Backup → Your library).
3. The default, %LOCALAPPDATA%\CaseKeeper.

# Per-user, persistent
setx CASEKEEPER_LIBRARY "E:\SecureVault\CaseKeeper"

In the app:

• Move library copies everything, verifies every file byte-for-byte, checks the database opens, and only then deletes the originals. Any failure leaves the original untouched.
• Use a different library… opens an existing library elsewhere without copying anything; choosing an empty folder starts a new library there.
• If the library can't be reached at startup, CaseKeeper offers to retry or pick another folder — it never silently recreates an empty library in a folder you chose.

Network & shared libraries

A library can live on a NAS or SMB share, and several PCs can point at the same folder — one at a time.

• On network paths the database switches from WAL to the rollback journal (journal_mode=DELETE), because WAL needs shared memory that SMB doesn't provide.
• While open, CaseKeeper writes .casekeeper-in-use.json (machine, user, process, timestamps), refreshed every minute. Another PC opening the same library is warned first.
• A marker left by a crash or dropped connection goes stale after 3 minutes and stops counting.

Password protection

• Turn on under Settings & Backup → Password protection. Every document file and the entire database (notes, OCR text, search index, timeline, complaints) is encrypted at rest with AES-256.
• Documents are decrypted only in memory — viewing, searching, OCR and bundle building never write a readable copy to disk.
• Changing the password is instant (only the wrapping key changes). Protection can be turned off again.
• There is no recovery. A lost password means permanently unreadable data — there's no admin override or escrow. Keep backups.

Backup & restore

• Settings & Backup → Create backup writes one .zip with the database and every document, optionally AES-256 encrypted.
• If the library is protected and the backup isn't, CaseKeeper warns and offers to add a password.
• Import either adds to the current library (duplicates skipped; safe to repeat) or replaces everything (disaster recovery / new PC).
• Factory reset sits behind a typed confirmation and an offer to back up first.

For scheduled protection, back up the library folder with your normal file-backup tooling while CaseKeeper is closed (an open database may be mid-write), or use the in-app backup.

Privacy & security

• No network use. CaseKeeper makes no internet connections: no account, telemetry, updates check or cloud OCR. Text recognition uses the engine built into Windows.
• Original files are never moved or modified — they're copied into the library and fingerprinted for duplicate detection.
• Sharing uses the Windows Share sheet, behind a confidentiality reminder.
• Library data is sensitive family-court material. Avoid cloud-synced folders unless that's intended, and apply appropriate retention.

Identifiers

Detection rule: the uninstall key's DisplayVersion, or the file version of CaseKeeper.exe.

Code signing & Smart App Control

The installer and app are not code-signed today.

• Smart App Control is off on enterprise-managed devices, so it won't block managed deployments.
• For App Control for Business / AppLocker, allow by hash or path (%ProgramFiles%\DarkCipher0x Systems\CaseKeeper\*); refresh hash rules each release.
• Verify downloads with the published SHA-256, or build from source and sign with your own certificate (add a SignTool line to installer\CaseKeeper.iss).

Home-user guidance: Managing Smart App Control.

Troubleshooting

Dev environment

Get the code from the Source Code page.

Building

# Debug build and run
cd CaseKeeper
dotnet build
dotnet run

# Release installer → dist\CaseKeeper-Setup-v<ver>.exe
cd ..
powershell -ExecutionPolicy Bypass -File build-release.ps1

build-release.ps1 publishes self-contained for win-x64 into publish\, compiles installer\CaseKeeper.iss, and prints the installer path, size and SHA-256. It warns if CHANGELOG.md has no entry for the version being built. The installer's version is read from the built exe, so it can never disagree with the app.

Project layout

Data model

A single SQLite file, casekeeper.db, in the library folder. WAL journal locally, rollback journal on network paths.

User search input is converted into a safe FTS5 query (every word must appear, prefix match; quoted phrases match exactly).

Encryption design

password ──PBKDF2-HMAC-SHA256 (600,000 iters, random salt)──▶ wrapping key
wrapping key ──unwraps──▶ random master key
master key ──▶ AES-256-GCM for every document file   (nonce 12 | tag 16 | ciphertext)
master key ──▶ SQLCipher passphrase for casekeeper.db

• Implemented in Services/Vault.cs; key material in vault.json (salt, iterations, wrapped key, verifier).
• Changing the password only re-wraps the master key — no document re-encryption.
• GCM authenticates as well as encrypts, so tampered files fail to decrypt rather than returning garbage.
• SQLCipher comes from SQLitePCLRaw.bundle_e_sqlcipher.

Services

Dependencies

Target framework net8.0-windows10.0.19041.0, minimum OS 10.0.17763.0, self-contained win-x64.

Release process

1. Bump the version in CaseKeeper/CaseKeeper.csproj — Version, AssemblyVersion, FileVersion and InformationalVersion must agree. Patch for fixes, minor for features, 1.0.0 when stable.
2. Write patch notes at the top of CHANGELOG.md (## v0.2.2 — date, then Added / Fixed).
3. Build: powershell -ExecutionPolicy Bypass -File build-release.ps1.
4. Test the upgrade on a machine with the previous version and confirm documents survive.
5. Commit and tag: git tag v0.2.2, git push origin main --tags.
6. Publish the installer with its SHA-256 in the release notes.

GitHub Actions

.github/workflows/release.yml runs on windows-latest whenever a v* tag is pushed (or manually):

1. Sets up .NET 8 and installs Inno Setup via Chocolatey.
2. Runs build-release.ps1.
3. Fails if the tag doesn't match <Version> in the project file.
4. Creates a draft GitHub release with CHANGELOG.md as the body and the installer attached.

Contributing

• MIT-licensed — fork, modify and redistribute with the copyright and licence notice intact.
• Keep it local-first: no network calls, no telemetry, never modify a user's original files.
• Never test with real case documents in bug reports — use dummy files.
• Questions or patches: email or Discord.