[Dovecot] rawlog adjustment

Dear All,

We would like to use rawlog to make sure when does user delete email, can we filter particular command that user sent to dovecot server instead of log the whole email content as well? how would you all provide prove to client that mail lost is not caused by your server?