More 3.4 calendar woes

[Homer Dokes]

Hi Andy,

Thanks for the information.

I can tell you that, at least in this case, this was not a case of 
deletion or expunging.  The symptom of missing contacts and calendar 
events occurred simultaneously.  The user in this case, does not have 
the ability to delete the files from the respective folders in question 
here (contacts and calendar events), and in fact, they were still 
present in the folders, and not marked for deletion via the flag.  He 
obviously does have the ability to do this to actual email (message) 
files via any client he has but they were not affected in this case.

You do bring up an interesting reference however.  This user, do many on 
this system, does use Outlook as their client on the pc (it never lost 
anything) and the iPhone.  Were you able to determine if the user of the 
iPhone had initiated the expunging of messages or if it occurred without 
initiation by the user?

I was not aware that messages and folders are expunged in 69 days.  This 
is good information to know.  Rest assured, we maintain daily backups of 
the entire email system which was most advantageous just a few weeks ago 
as their file server was hit by a ransomware attack which encrypted all 
files.  Fortunately we did not have to pay a ransom because we had daily 
backups.

For clarification only, this issue did not affect email messages... only 
the users contacts and calendar events.

Thanks again Andy, I really appreciate the information.

hdokes

On 8/19/2015 9:12 PM, Andy Kopciuch wrote:
> To me it sounds as though the messages in the Contacts folder were deleted and
> expunged.   I experienced this on a normal mail folder folder for a user
> recently (problem with an iPhone - expunged all messages).
>
> In Kolab 3 - deleted messages can be in 3 states (not just 2).
>
> 1.  Deleted - the IMAP deleted flag is set, and depending on the client
> settings the message will still be visible to the user.
> 2.  Expunged - the message has been _deleted_ from the folder.   It is no
> longer available to the user.   The message does still reside on disk in the
> folder, and is mapped in the cyrus.expunge file.
> 3.  Expired - Cyrus (cyr_expire) will automatically run and "expire" all
> expunged messages older than 69 days ... the default value in kolab.   This is
> when the message will be permanently removed from disk.  To recover ... you
> need to have a backup.
>
> Using some cyrus tools, and the kolab cli client, you can see expunged
> (deleted) messages and folders, and restore them within the 69 day period.
>
> https://docs.kolab.org/administrator-guide/backup-and-restore.html
>
> You can list all messages, and restore a single message by UID, or restore all
> expunged messages in a folder.
>
> removing the index, and header files, and then reconstructing will reset the
> seen flag and all messages would appear as new.  If this happens to you again,
> I would check to see what the expunged messages look like, and possibly you
> can just restore them, instead of reconstructing.
>
> Hope that helps,
>
>
>
> Andy
>
>