auto-deleting dates? why, how, who? undelete messages?

[Matthias Busch]

Hi,

I seem to have lost dates in a calendar. but why, how and if it was a 
user error, who?

I have three users, lets call them Child, Mother, Father

user Child has  three calendars:
"Calendar Child" and two sub-calendars "School" and "Private"

"Calendar Child" and "School" are both shared with Mother and Father 
(full access)
"Private" is not shared

"Child" has had no way of logging in.

Mother and Father have created dates in "Calendar Child" and "School"

Now Mother informs me (Father) that some dates (at least "Homework") 
have gone missing. I can not remember deleting any messages myself. 
Neither can mother...

When looking (imap) into the folder Calendar Child/School I can see two 
mails/kolab xmls.
When looking in 
/var/spool/imap/domain/d/domain.tld/c/user/child/Calendar Child/School I 
can see ~20 messages (11. - 37.) as well as the cyrus.* files

cat *. | grep "Homework" I get 4 hits with <text>Homework</text>

(4 dates seem to be what we expect to see. any they were in the near 
future, not long past)

Now, so far I deduce the following:
the kolab-mails with the actual dates have been marked deleted.
the calendar will not show the dates because they are "gone"

in the webmail interface I can not browse that folder (with "hide 
deleted messages" disabled)
with thunderbird I can not figure out how to show deleted messages

now, questions:
- can I find out when the messages have been deleted?
- can I find out who deleted them, possible how?
- how can I undelete messages via command line? (the cyrus command 
unexpunge seems not to work)

- whats up with kolab examine-message? how does it want the 
folder/message parameter?

---

I love kolab and all and right now, I have no reason to believe that 
this is NOT a user error. But I really would like to get to the bottom 
of this. I can not have a system that deletes messages on its own...