Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just wondering if someone can help. I have a customer email and website hosted on my server and a customer logged into their squirrel mail account (via my server) and deleted an email that arrived today which contain some important information they need.

The email was sent to them via a phpmail webform script on this same server.

Is there a way I can find out what the email is they deleted from the server log files (although in var/log/mail.* logs are all empty). I know my way around linux to perform basic operations but not enough to know if this is possible?

Thank you

share|improve this question

No, there is no place that the email is stored other than the User's inbox. It's gone.

share|improve this answer

This depends on entirely how it was deleted, if it was done through the squirrel mail interface then you may have a record of it in the logs depending on the verbosity of your logging. You don't mention the backend but assuming file backed storage with no explicit backup mechanism in your configs the file is well and gone. There is no easy way to get it back.

share|improve this answer
the user deleted the mail then purged the trash folder then realised it was the wrong email! I am not sure what type of backend as this is a webfusion ubuntu server with everything ready to go. I am wondering if there is a record of sent emails on the server as it was physically sent via the server or if there are logs of received emails? Not sure where I look or what to look for? – belliez Nov 3 '09 at 19:50

Since you are posting here I guess it was an important mail?

I have accidentally deleted code that I didn't want to delete in the past. What I did was to read the partition as text into another partition and then search for phrases that I knew was in that code. I realized that the code had been saved on different places every time I had saved the file, so I found many versions of it. I guess you're not that lucky. Nevertheless, if you're desperate, it's an option.

I used the unix tool "strings" to read out the partition. And since that gave me a 20GB textfile, I used the tool "split" to make sufficiently small files that I could search in.

Be careful not to export the partition into itself (obviously it won't fit, and you would overwrite the free space that you're supposed to read). That's what I did - but I was lucky and found it anyway...

If there are easier ways to do the same thing, let me know...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.