Restore deleted mail

[lr]

Of the four mailboxes we use for our domain, one has suddenly lost all of its e-mail. Most likely, this was caused by user error: Hit Alt-A to select all messages, then hit delete by mistake, and then fail to notice. And this morning, I cleaned up all the e-mail messages in the Trash folder, because too much Graymail had accumulated in there, and I may have completely wiped out the messages that were deleted by mistake.

The deletion probably happened either Monday evening or this morning. The messages are gone as seen from IMAP, and seen from the web mail interface.

How to restore them? I looked on the Sonic wiki, and found the wiki page for "Restore Deleted Email" at https://wiki.sonic.net/wiki/Restore_Del ... l_Messages. Unfortunately, it has no information about what to do when the mail is no longer in the Trash IMAP folder. It does mention the snapshots that are available on the file system, and points back to the snapshot page at https://wiki.sonic.net/wiki/Mail_Snapshot_FAQ and https://wiki.sonic.net/wiki/Retrieving_ ... ot_Backups, but those don't talk about where to find the mail spool, so I don't know where to look for snapshot directories.

(This actually points to a general question: I don't know how to find the file system location of the mail spool from the shell account. This may be a good thing, because changing files in the mail directory will usually do more harm than good. Although, it's sometimes convenient to be able to access all mail using shell tools. But this question is really a side show).

So, how does one go about restoring mail? Can I do it myself? Or is the most efficient way sending an e-mail to support?

[lr]

Never mind ... the e-mail was found. A certain computer user in our household (*) took it upon himself to sort all his mail into folders, and organize it. Good thinking. Did it really neatly too. Unfortunately, he sorted it into folders stored on his laptop instead of on the IMAP server. Then this afternoon, when he couldn't get to his e-mail over the web, I panicked.

Footnote (*): That computer user needs to be spanked, and is still of an age where me (dad) can spank him (high school freshman). Rearranging your e-mail without consulting with the sys admin first ... kids these days ... so now I'll have to set up backups for his laptop.

[dane]

Glad to hear there was a happy ending. Sounds like a good technology teachable moment. Maybe make him read our IMAP FAQ: https://wiki.sonic.net/wiki/IMAP_FAQ

[virtualmike]

Hmmmm... ISTR seeing documentation in the past that one can recover email from the mail snapshots by using a modified login ID within the mail client (no navigation needed to specific mail folders).

However, now I find a circular reference between https://wiki.sonic.net/wiki/Mail_Snapshot_FAQ and https://wiki.sonic.net/wiki/Retrieving_ ... ot_Backups.

[kgc]

When we migrated to dovecot we did not port over the ability to login to the snapshot directories via POP and instead replaced it with the DELETED_MESSAGES namespace (where all mail deleted via POP goes before expiring after two weeks.) This allows users to reliably restore messages on their own that they've delete using POP as opposed to hunting for it in the snapshots which generally was an exercise in futility.

[thulsa_doom]

Hmmmm... ISTR seeing documentation in the past that one can recover email from the mail snapshots by using a modified login ID within the mail client (no navigation needed to specific mail folders).

However, now I find a circular reference between https://wiki.sonic.net/wiki/Mail_Snapshot_FAQ and https://wiki.sonic.net/wiki/Retrieving_ ... ot_Backups.

The old method of recovering mail directly from snapshots using POP3 is no longer available. If you delete messages through the pop3 protocol (many mail clients delete from the server by default, which can lead to sorrow), they are put in an IMAP namespace called "DELETED_MESSAGES" where they can be retrieved by an IMAP client (such as webmail). Messages deleted from the IMAP trash folder are properly deleted.

I fixed the circular reference feedback loop; the snapshot FAQ refers to the "Restore Deleted Email Messages" article now. Restoring mail from snapshots is exactly like restoring any other file from snapshots these days. Snapshots of previous states of your mail folder are still kept in a .snapshot directory for a limited time, but may not contain all messages deleted (e.g. a message was delivered and deleted between snapshots) and are not directly accessible from mail clients.

[lr]

In the meantime, I found an answer to an unimportant side show question:

(This actually points to a general question: I don't know how to find the file system location of the mail spool from the shell account. This may be a good thing, because changing files in the mail directory will usually do more harm than good. Although, it's sometimes convenient to be able to access all mail using shell tools. But this question is really a side show).

For normal accounts: Log in to the shell machine. Look at the environment variable $MAIL. It points to a directory /var/spool/mail/XX/YY/<username>. In there you find all your e-mail, in Dovecot mail format (which is easy to figure out, in particular if you run a dovecot server yourself). Judging by the output of mount, this comes from a handful of (probably very large) NFS servers, and judging by how they are set up, they are probably built by a bay area appliance company with a stellar reputation (name withheld so the heads of my friends who work there don't swell too much). And if you go back to the mount point (a.k.a. NFS volume), you can find the snapshot directories there.

For mailboxes (which are not real users), this doesn't seem to work. I think in terms of mail infrastructure, they are implemented as different users, with different spool directories. In terms of authentication, I don't know whether they have different UIDs from the main account or not. So AFAIK, their mail can't be found by logging into the shell machine. Which doesn't cause me any particular problem, although occasionally it might be convenient to see all ones mail as flat files.

[virtualmike]

Thanks, Kelsey and John, for the updates.