Recovering expunged but not purged e-mails from mdbox with zlib compression

[Aki Tuomi]

You can use mdbox_deleted driver to access mails with refcount 0. See
https://wiki2.dovecot.org/MailboxFormat/dbox

Aki

On 10.11.2020 12.42, Daniel Schütze wrote:
>
> Yesterday I had to recover an e-mail which a user had deleted.  If I
> understand this correctly the message was expunged but not purged
> (doveadm purge had not been run).
>
> This e-mail was clearly still in the mdbox stored with zlib
> compression as I could tell using the doveadm dump command (doveadm
> dump -t dbox filename).
>
> I could however not reveal the e-mail with the normal doveadm fetch -u
> username "body" guid (guid from dump output)
>
> In the end I was able to recover the e-mail by cutting it out from the
> mdbox and running gunzip over it, but this method was very fiddly and
> would not have worked for a bulk job.  I appreciate I could have just
> deleted the index files and gotten all the deleted messages back by
> having the index rebuilt but that would have been the proverbial
> "hammer to crack a nut".
>
> Fortunately this e-mail had no attachment for me to worry about, as
> those are also detached for sis by dovecot.
>
> Can anyone tell me of a quick and easy way to recover one or multiple
> e-mails marked as expunged but not purged which are stored in a mdbox
> with zlib compression?  I'm sure I'll have to do this again the future
> and my method wouldn't work with a folder!
>
> Clearly if I was not using zlib compression I could just have read the
> contents of the mdbox without any complication.
>
>
> -- 
> Daniel Schütze
> Director
>
> ------------------
>
> CWA International Ltd
> 5th Floor, 42 Trinity Square
> London
> EC3N 4DJ
>
> (t) + 44 (0)20 7242 8444
> (e) dms at cwa.uk.com
> (w) http://www.cwa.international/