mails vanished

[Andrew Morgan]

On Fri, 26 Oct 2012, Andre Bischof wrote:

> Hi,
>
> I'm using cyrus for years now, and have to say that it is a great piece of
> software, best fitting to my needs.
>
> Actually I use 2.2 (imap,pop3 amongst others) with Debian stable/testing.
>
> Two days ago I had to recognize that my mail client (thunderbird) only
> showed a handful of mails in my inbox when there should be thousands,
> reaching approx. 10 years back.
>
> Strange enough, my snapshot backup (faubackup) showed only a few more,
> going days, weeks and month back.
>
> I assumed there might be a problem with the disk and tested it thouroughly,
> but neither chkdsk nor SMART or other utilities would show errors or
> problems.
>
> I checked mail logs and aptitude.log as well, but there was nothing of
> interest to me, neither updates nor lots of deleted mails, only some
> expunged ones, but not too much.
>
> At this very moment I'm recovering files using testdisk - at least
> something.
>
> Could one of you tell me whether it's ok to just copy recovered files back
> to /var/spool/cyrus/mail/f/user/f-user/ ? Or am I supposed to recover with
> cyrus admin tools like:
>
> sudo -u cyrus /usr/sbin/cyrreconstruct -C /etc/imapd.conf -rf user.BENUTZERNAME
>
> The file cyrus.header only contains:
>
> Cyrus mailbox header
> "The best thing about this system was that it had lots of goals."
>    --Jim Morris on Andrew
>    478a94914314724f
> NonJunk Junk $Forwarded $MDNSent $Label1 $Label2 $Label3 $Label4 $Label5
> $has_cal
> frisco    lrswipcda
>
> Any hints to recover my mails are VERY ;) appreciated, as well as
> suggestions what might be the cause of the problem.

You can copy the recovered ###. files back into your normal mailbox 
directory and then run reconstruct (and quota -f, if you have a quota) 
afterwards.  Until you run reconstruct, the messages won't appear to IMAP 
clients.

I can't tell you anything about why the messages were deleted though.  :)

 	Andy