Topic: Way to recover lost email on server after email client deleted it.

[JRBATM20192021]

Hello,

Is it possible to recover emails that are lost after an email client deleted them? I have a server user who needed to redo there email program installation after there computer crashed all of there email was on the server so there was no issue. However we download the new version of Thunderbird but after setting it up and receiving all the email from the server we opted to switch to the older version of Thunderbird since the new one was not working well enough for them. However after uninstalling Thunderbird and installing the older version of Thunderbird and setting up there email on it all the emails from there inbox are gone and there are no emails from there inbox left on the server it is like the new version of Thunderbird downloaded all of the emails when we installed it but then opted to switch to the older version it deleted all of the email's from the inbox on the server as well. However strange enough it just deleted the inbox off of the server not the trash or the sent box all that email is still there. So I guess my question is, is there a way to recover the inbox from that email account on the server to get all of the inbox email back? My server version is SME 10 and the email client we were using is Thunderbird started with the new version than switched to the old version and that is when the inbox got deleted.

Thanks

[mmccarn]

Maybe the newer Thunderbird set itself up as a POP3 client, and deleted everything once it was downloaded?

I feel sure there's a more straightforward way to do it, but this command will give you counts of emails by folder for <username>:

Code: [Select]

# navigate to the user's mail folder (replace <username>)
cd /home/e-smith/files/users/<username>/Maildir

# find all the files in all subfolders, cut off everything after the second "/" and output counts
find . -type f |sed 's|[^/]*/\([^/]*\).*|\1|' |uniq -c

or simply use find . to see what's there.

If the email is still there it will show up.  If nothing shows up you may need to restore a backup. If I'm right about Thunderbird having decided to use POP3 then the email should be in a thunderbird profile on the client computer and in the '.Trash' or '.Deleted Items' folders on the server.

[JRBATM20192021]

So when I type in the commands I get the following for the account in question

5252. junkmail
3 cur
1 dovecot.index.log
1 dovecot-uidvalidty
1 dovecot-uidlist

6265. Sent
1 dovecot.index.cache
1 dovecot-keywords
6 .Drafts
1 dovecot.index

33051 .Trash
1 subscriptions
1 dovecot.mailbox.log
7 .Archives.2023
4 .Archives
6 .Archives.2022
1 dovecot-uidvalidity.60ee986c
1 dovecot.index.log.2

But no Inbox so how do I look into the Trash or Deleted Items on the server to determine if the Inbox is in there? That's the only thing missing we have everything else Trash/Sent and even the drafts scary enough just not the inbox

Okay we completely uninstalled the newer thunderbird and switched to the old version we had. I didn't download the older version as a conventional download like the new one so I don't think I have a user profile. If I reinstalled the new thunderbird would I get the thunderbird profile back?

[JRBATM20192021]

Are the archives the place to look? How do I look at them? They are not available in Horde.

[ReetP]

Sounds very much like you mistakenly setup Thunderbird as a POP3 client (instead of IMAP) and that downloaded all the received mail in the inbox to the computer. It probably would not have downloaded any other folders.

If the mail is anywhere, it will be in the profile you setup, assuming you didn't delete it when uninstalling etc.

I would try and backup any profiles you have before touching anything.

You can check the old profile folder for size and see what is there.

You may be able to recover the mail after.

But see what you can find on the desktop first.

[JRBATM20192021]

Yes I think it defaulted to Pop3 instead of IMAP even thought IMAP was selected. Okay so far nothing with the computer I removed Thunderbird completely including deleting the files I assume because they are not there anymore. (Unless you guys tell me different), I didn't delete anything myself it would have been when the program uninstalled if it deleted anything. There are backups the problem is they don't have all the email's on them for this account and we need them all. This just happened about 4 hours ago so even a constant everyday backup wouldn't have helped. How do I access the old profile to look at what mail is there and see what I can recover? I can see it on the GUI but I can't see it in the email program or on Horde.

[cno]

if you are lucky you can find emails here

Windows: C:\Users\UserName\AppData\Roaming\Thunderbird\Profiles\****.default-release\mail\Local Folders

Mac OS: ~/Library/thunderbird

it is guaranteed because you had thunderbird set up for pop3 as already mentioned

[ReetP]

There are likely no simple solutions here.

There will be nothing "in" Horde. That is on the server and only allows you to see mails still on the server.

If the mails have been retrieved via POP the only place they still exist is on the client desktop.

At best they are in a profile on the Thunderbird computer.

( Linux is ~/.thunderbird )

You need to tell us what OS your desktops run.

You can run Thunderbird to check the profiles from the command line with:

Code: [Select]

thunderbird -P
https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-thunderbird-profiles

But you need to make sure the profile is backed up before playing - it is the only place where your mail may still reside.

If you can find the directory you MAY be able to

Start Thunderbird
Setup IMAP

Import old profile data:

https://support.mozilla.org/en-US/kb/thunderbird-import

There may be other obscure recovery techniques but be extremely careful as it will be easy to lose everything.

You essentially have to have an IMAP account, open the old Inbox, and copy back to the IMAP Inbox

[JohnG]

Yes, backup whatever you currently have first before playing.

I just looked at my latest thunderbird profile and there's a bunch of larger sqlite files, so the messages might still be retrievable from there as well.

In the meantime, try webmail, see what's actually on the server. Check the trash, deleted items, etc. Look at the archives folders.

[ReetP]

The sqllite files just contain the search data that Thinderbird generates and uses to speed up searches. They contain no mail IIRC.

Any mails will be stored in sub folders in the profile.

You could check the Trash -> 2023 Archive directory on the server via Horde in case they got accidentally moved there. It should appear in Horde.

Otherwise you need to dig into the client profile directories.

[JRBATM20192021]

No Luck so far. When you talk about sub-folders do you mean on the Email Client computer? Not Sure where to look because the file that the  sqllite files are in is the only one I knew where to look at and can find. On the server for the affected Profile the inbox is missing but the Trash, Sentbox and the drafts are still there. The 2 archive files only contained a few emails in them. Is there anywhere else on the server to look? Can I access the profiles mail files via FTP on the server? I thought those 2 were completely different.

Thanks

[ReetP]

Can't say much til I get home and get on a desktop.

The sqllite files are not relevant. They just hold caching data to speed up Thunderbird searches. Aa far as I'm aware you can't retrieve anything useful there.

As far as I can guess there are two possible scenarios here.

1. The user used IMAP and accidentally drag/dropped/moved the inbox and it is somewhere on the server (unlikely). This also does not explain where mail is going currently?

What does this show for the user? (Note there will be no "Inbox" - the Inbox files are in cur and new)

All other folders will be hidden eg .Sent, and contain new, cur, tmp.

Code: [Select]

ls -lah /home/e-smith/files/users/{user}/Maildir
2. The user setup POP3 and downloaded all mail to the client PC (which OS is it running?) That mail will be stored in a set of sub folders in the client profile directory similar to the above. We ought to know which format they were stored - probably the same mbox as per the server IIRC.

If that profile and/or folders have been deleted you have lost your mail unless it was backed up.

You will have to advise the desktop OS so we can look at specifics.

[JRBATM20192021]

Unfortunately I won't have access to the server again till Monday so I can't answer your one question about what the command will produce but I can answer your other questions.

The user did use Imap we always do it really seems like the new version of thunderbird seems to do what it wants and it seems it changed the setting to POP3 maybe.....

There is an inbox now but mail only goes back to Dec 5th when the issue happened so the user is still receiving email but doesn't have anything before Dec 5th. So if I run the original commands now it will probably show an inbox now. The issue had just happened when I ran the commands you guys gave me on the 5th. I like to think I know my server well but I still have a lot to learn where could I possibly look to see where the inbox might be hiding?

In the POP 3 department wouldn't setting up Thunderbird as pop 3 also take off the sent, drafts and trash folders on the server? The OS the client computer is running is Windows 7. The sqllite files are there I just have not had a chance look for more files on that machine. All I did was uninstall the new version of Thunderbird so unless it deleted the profile its self it should still be there??

[ReetP]

Before touching anything make sure the client PC Thunderbird profiles are backed up.


POP3 will only retrieve Inbox. Read online for why etc.

I think Thunderbird asks about IMAP/POP on setup. It's unlikely to change by itself. The automated account system setup possibly detected/guessed POP before IMAP. (Hence I use policies to stop this happening!)

Uninstalling - I think the data may be in the profile on the client unless you changed or deleted anything. But can't be sure. As you swapped versions there may be more than one profile in there.

https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-thunderbird-profiles

Careful you do not start with an old POP profile - you may lose more mail!!

Use profile manager to see what Thunderbird sees. You can then look directly in the sub folders with a file browser. Make sure you can view hidden files & directories.

Unfortunately the reason I state in my sig to not ask about unsupported OS is I don't have W7 to test any more so can't help there. You are going to have dig in on the client PC and have a look.

You will likely need to use the latest version of Thunderbird as the profiles get modified on upgrade and old versions will have no access to them.

If you can then I'd try the following:

Remove the Thunderbird password database, or modify the server name, so when you restore the profile it does not collect more mail (or disable POP access on the server?)

If you can see the POP mail, create a new IMAP account to the right mail account.

Copy POP inbox to IMAP inbox

There may be other more manual methods that you can research.

Good luck.