4

A server that I'm helping to administrate had a severe file system problem and now there's a lot of files inside the /lost+found directory. I'd like to find the user@example.com's received and sent mail boxes. We're using Maildir email format, Postfix as MTA and Dovecot as POP3/IMAP server on a Debian Squeeze.

I've already tried

grep -r ".*user.*"

and

grep -r ".*From: \"John Doe.*"

The majority of the results where files like 1412216683.V804I9e3a201M324743.example inside directories like Maildir10805257/new/. Since there are many different Maildir/new directories, I'd like to know if there's a specific one that is the user@example.com mailbox and if so, if someone knows a better way to find it. Otherwise, are his remaining messages spread all around these directories?

  • 1
    I'd use the Delivered-To: field to identify the correct owner. – sebix Apr 8 '15 at 20:01
2

For received email, you can rely on Delivered-To to identify the correct recipient as @sebix has said in above comment.The challenge is, if the email has more than one Delivered-To header. So you must modify the grep to search user@example.com mailbox

grep -r -m 1 '^Delivered-To:' directory/ | grep user@example.com

For sent email, you can rely on From header. Again, you should limit it in first occurrence.

grep -r -m 1 '^From:' directory/  | grep user@example.com
  • Thanks! That really helped me. I was almost giving up, because I was starting to think that each user's mailbox that appeared in the /lost+found directory would be split in several Maildirxxxxxx directories, which apparently is not the case: using the command you suggested (except for the -m 1 part), I found another user mailbox where all his received email were inside Maildirxxxxxx/new and the received ones in Maildirxxxxx/.Sent. So I'd say it's just a matter of digging deeper :) – Álvaro Lemos Apr 10 '15 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.