Yesterday I had to recover an e-mail which a user had deleted.  If I understand this correctly the message was expunged but not purged (doveadm purge had not been run).

This e-mail was clearly still in the mdbox stored with zlib compression as I could tell using the doveadm dump command (doveadm dump -t dbox filename).

I could however not reveal the e-mail with the normal doveadm fetch -u username "body" guid (guid from dump output)

In the end I was able to recover the e-mail by cutting it out from the mdbox and running gunzip over it, but this method was very fiddly and would not have worked for a bulk job.  I appreciate I could have just deleted the index files and gotten all the deleted messages back by having the index rebuilt but that would have been the proverbial "hammer to crack a nut".

Fortunately this e-mail had no attachment for me to worry about, as those are also detached for sis by dovecot.

Can anyone tell me of a quick and easy way to recover one or multiple e-mails marked as expunged but not purged which are stored in a mdbox with zlib compression?  I'm sure I'll have to do this again the future and my method wouldn't work with a folder!

Clearly if I was not using zlib compression I could just have read the contents of the mdbox without any complication.