<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 07/09/17 06:26, Liutauras Adomaitis
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:28943005.1DWahV2sS1@xps.namu.tinklas">
<pre wrap="">On 2017 m. rugsėjo 3 d., sekmadienis 16:39:59 EEST Sruli Saurymper wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 03/09/17 13:41, hede wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Am Sun, 3 Sep 2017 10:40:03 +0100 schrieb Sruli Saurymper
</pre>
</blockquote>
</blockquote>
<pre wrap=""><a class="moz-txt-link-rfc2396E" href="mailto:sruli@saurymper.com"><sruli@saurymper.com></a>:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">I have looked at their email client (thunderbird) and roundcube and the
email is not there, however when I checked the server
(/var/spool/imap/domain/d/domain.com/n/user/name/) the email is clearly
there.
</pre>
</blockquote>
</blockquote>
</blockquote>
<pre wrap="">
You could check it via telnet / openssl s_client.
Search the web for how to do so. For example:
openssl s_client -crlf -connect imapserver.example.com:993
A login imapuser imappassword
B select INBOX
C UID SEARCH FROM "somebody"
-> check if your mail is found
D fetch 123 rfc822.header
-> if it's mail #123, then check if it's readable
E logout
Maybe it's marked as deleted (for examble by a spam filter like
mailwasher) so thunderbird and roundcube won't show it. Or the cyrus-,
thunderbird- and/or roundcube databases are corrupted - there are a ways
to fix this. (
thunderbird: rebuild imap tree by rebuilding the global database.
cyrus: "su - cyrus; /usr/lib/cyrus-imapd/reconstruct -r
user/[<a class="moz-txt-link-abbreviated" href="mailto:username@domain.tld">username@domain.tld</a>]">
)
I'm just guessing - I don't have any real clue...
</pre>
</blockquote>
<pre wrap="">
Couldn't fetch any headers but the search found 6 emails, I have 6 in
the Inbox, so it did not find the one in question.
How can I check if a email has DELETED flag?
</pre>
</blockquote>
<pre wrap="">
You can use:
/usr/lib/cyrus-imapd/cyrdump <mailbox> | less
command to dump mailbox. That should also have a list of messages with deleted
flag.
/usr/lib/cyrus-imapd/unexpunge -l <mailbox>
command should show the list of email which are expunged from the mailbox, but
still available for recovery. Unlike as with /deleted flag, the recovery of
expunged emails can be done by Cyrus IMAP addministrator from console only.
Messages expunged from mailbox are not accessible for user via IMAP in any
way.
Liutauras</pre>
</blockquote>
Thanks, /usr/lib/cyrus-imapd/unexpunge -l <mailbox> did show
that they are expunged.<br>
However you wrote that expunged email are only recoverable by
console, I wonder how the MailWasher application can read it. <br>
Most importantly how / where can I see in the logs the full trail of
how / who deleted / expunged the email?<br>
<br>
Many thanks<br>
Sruli<br>
<blockquote type="cite"
cite="mid:28943005.1DWahV2sS1@xps.namu.tinklas"><br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:users@lists.kolab.org">users@lists.kolab.org</a>
<a class="moz-txt-link-freetext" href="https://lists.kolab.org/mailman/listinfo/users">https://lists.kolab.org/mailman/listinfo/users</a></pre>
</blockquote>
<br>
</body>
</html>