I have a number of Crystal Reports (9) report files that are distributed with a legacy VB6 application. When distributing the application to different customers i'd like to make sure that the original servernames and login information is not contained in the .rpt-file anymore. The login information is set in the code anyway.
As soon as i try to remove the Connection information in Crystal Reports Designer all the table and file information gets lost, too :(
I don't think there is a way to do what you are asking in the CR designer, since within the connection are your objects included in the report. No connection, no objects (as you've already discovered).
We use CR7 and CRXI in a production environment for software that is distributed to thousands of clients. All reports are developed using a private data location that is not accessible from the outside world. Even if someone managed to gain access, their efforts would be fruitless since no sensitive data is contained within the dev server. Credentials to production environments should never be kept with a report file unless that report file is used ONLY for that environment and nobody else's.
At the very least I would advocate creating another instance of the DB server if having another dev machine isn't possible, that way at least your log-on credentials do not point to a production environment. I've never personally had to do this, so if you decide to go this route and need help I suggest asking the folks over at ServerFault.