Yesterday I had to recover an e-mail which a user had deleted. If I understand this correctly the message was expunged but not purged (doveadm purge had not been run).
This e-mail was clearly still in the mdbox stored with zlib compression as I could tell using the doveadm dump command (doveadm dump -t dbox filename).
I could however not reveal the e-mail with the normal doveadm fetch -u username "body" guid (guid from dump output)
In the end I was able to recover the e-mail by cutting it out from the mdbox and running gunzip over it, but this method was very fiddly and would not have worked for a bulk job. I appreciate I could have just deleted the index files and gotten all the deleted messages back by having the index rebuilt but that would have been the proverbial "hammer to crack a nut".
Fortunately this e-mail had no attachment for me to worry about, as those are also detached for sis by dovecot.
Can anyone tell me of a quick and easy way to recover one or multiple e-mails marked as expunged but not purged which are stored in a mdbox with zlib compression? I'm sure I'll have to do this again the future and my method wouldn't work with a folder!
Clearly if I was not using zlib compression I could just have read the contents of the mdbox without any complication.
-- Daniel Schütze Director
CWA International Ltd 5th Floor, 42 Trinity Square London EC3N 4DJ
(t) + 44 (0)20 7242 8444 (e) dms@cwa.uk.com (w) http://www.cwa.international/