Recovering expunged but not purged e-mails from mdbox with zlib compression

[Daniel Schütze]

Yesterday I had to recover an e-mail which a user had deleted. If I 
understand this correctly the message was expunged but not purged 
(doveadm purge had not been run).

This e-mail was clearly still in the mdbox stored with zlib compression 
as I could tell using the doveadm dump command (doveadm dump -t dbox 
filename).

I could however not reveal the e-mail with the normal doveadm fetch -u 
username "body" guid (guid from dump output)

In the end I was able to recover the e-mail by cutting it out from the 
mdbox and running gunzip over it, but this method was very fiddly and 
would not have worked for a bulk job.  I appreciate I could have just 
deleted the index files and gotten all the deleted messages back by 
having the index rebuilt but that would have been the proverbial "hammer 
to crack a nut".

Fortunately this e-mail had no attachment for me to worry about, as 
those are also detached for sis by dovecot.

Can anyone tell me of a quick and easy way to recover one or multiple 
e-mails marked as expunged but not purged which are stored in a mdbox 
with zlib compression?  I'm sure I'll have to do this again the future 
and my method wouldn't work with a folder!

Clearly if I was not using zlib compression I could just have read the 
contents of the mdbox without any complication.


-- 
Daniel Schütze
Director

------------------

CWA International Ltd
5th Floor, 42 Trinity Square
London
EC3N 4DJ

(t) + 44 (0)20 7242 8444
(e) dms at cwa.uk.com
(w) http://www.cwa.international/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20201110/812bff5e/attachment.html>