all messages deleted from inbox

[Bernhard Reiter]

Hi Michael,

Am Dienstag, 24. Januar 2006 18:15 schrieb Michael Crumm:
> this morning one of my users called and said they logged in to find no
> messages in their inbox. 

what Kolab Server are you using?

> all messages in subfolders were intact.  i 
> checked the mail folder on the filesystem and literally no messages
> exist in the base of the user's folder.
>
> this user is setup for imap, using thunderbird 1.5  they also tried
> connecting over our webmail service, but of course, the result was the
> same.
>
> i checked all the imapd logs and there is no indication of any files
> being removed at all.
>
> 2 questions:  1) is there somewhere else i should be looking (i.e, other
> logs) to find out what happened? 

Check the contents of the imapd directory corresponding to the user.
Check it the backup.
This is where the emails should  have been.

I would also explore the structure of the user in there.

> and 2)the cyr_db log indicates that 
> some sort of backup was done last night at midnight.  i notice a few
> __db.00x files under imapd.  can i possibly recover the user's mailbox
> with these files?  if so, where might i find information on that process?

Cyrus Imapd comes with documentation and you can find more help
on the web. Their database files do not contain the mailbox content
as this is saved in regular files in the imapd/spool/...... structure.
The mailboxes.db file might have a list of known mailboxes.

If you find his email files, you can you cyrreconstruct to repair
the structure after copying them to the right place.
I think that not all transactions by users are logged because they
just do too much regularily. Anybody with write access to that account
could have deleted the emails. If could have been a client or user failure.
To find out you can see who has connected to the server.
If you see that problem more often,
you could set up more logging depriving the privacy of the users.