2
Emails content is gone
Question asked by scott - 8/5/2021 at 4:26 PM
Unanswered
User 123@domain.com uses his laptop, iPhone and Surface pro to check his email.  I configured his account to use IMAP/SMTP. Email app on laptop/surface is Outlook 2018.

Last night he checked his email before bed, everything was still there. 21:35est This morning, the entire INBOX is gone. 07:30est.  He still has email in his sent folder and deleted folder on his PC.  I'm trying to search in the logs when smatermail deleted all the mail in the inbox.  Which log do I search?

5 Replies

Reply to Thread
0
Kyle Kerst Replied
Employee Post
Hello Scott. This user's email getting purged would be something you'd find in the IMAP or EAS/MAPI logs depending on what protocol he is using on his Outlook installation.

Ultimately you should see manual deletes in our Administrative log if you're on our later releases, and any client-side deletes would take place in the appropriate protocol log.

If the delete happened via IMAP for instance you'd want to search that log for the EXPUNGE command relating to this user as that would indicate a delete. The EXPUNGE command will typically note a range of message IDs, so you'd want to look for something specifying a wide range of emails. 

If you need help tracking this down please don't hesitate to submit a ticket with us. Have a good one!
Kyle Kerst System/Network Administrator SmarterTools Inc. (877) 357-6278 www.smartertools.com
1
Nathan Replied
Whenever I see something like this I think, is there an email client inadvertently configured with POP rather than IMAP ?

The logs are useful but only if they are set with the appropriate verbosity but the resulting logs can be significant in size. We tend to only log exceptions by default.

It will not necessarily resolve the issue but if you backup during an overnight window between 21:35 and 07:30 are the 'grp' files present in the user's folder? Assuming you do backup knowing the time they ran plus if they were present or missing at this time reduces the window and may help locate a culprit.
0
scott Replied
Kyle thanks for the info.  I could not locate EXPUNGE in the logs during the time period.  Any other suggestions?
Charlotte Internet LLC
0
Kyle Kerst Replied
Employee Post
Scott, you are very welcome. You can check the Administrative logs to see if this user deleted or moved the messages manually via webmail. Beyond that I would recommend reviewing Nathan's suggestions as well as it's possible they may have POP'ed them down to an email client somewhere and could then theoretically upload them back via IMAP.
Kyle Kerst System/Network Administrator SmarterTools Inc. (877) 357-6278 www.smartertools.com
0
Scott, did you get this resolved ?

www.HawaiianHope.org - Providing technology services to non profit organizations, low income families, homeless shelters, clean and sober houses and prisoner reentry programs. Since 2015, We have refurbished over 11,000 Computers !

Reply to Thread