Deleted Message - Retreiving

[shirschberg]

Hello:

I am using Thunderbird 7.0.1 with Snow Leopard 6.8 on a Mac Mini.

Some how one of my Inbox messages has been deleted (I did not click the Delete Button on the Tool Bar), I was
however using the Delete key on the keyboard to remove some text from the message before saving it.

The message, had not yet been compacted

I closed out of Thunderbird and then came back to it an hour later and the message was no where to be found.

My e-mail account is Earthlink which is a POP account. I have checked my WEB mail, but the message is not there either, which I am greatly surprised at.

Is there anyplace else I should be looking for the message, or is there anyplace I can retrieve it from.

Thank you.

[tanstaafl]

If its a IMAP account switch to working offline using file -> offline -> work offline and see if its in the offline folder copy of the inbox. If so, copy it to local folders and then switch back to working online. Then you can either copy it back to the IMAP account or leave it were it is.

[makaiguy]

What follows assumes that this is a POP3 mail account (or that you have saved messages from an IMAP account locally in your Local Folders), that you have previously downloaded all the missing messages to the TBird installation on your computer, and that you deleted them from there.

If you have not yet compacted your folders, your deleted messages should still be in your profile where they can be recovered. Do NOT compact your folders until we get through this.

This will take some effort but it can be done.

Exit TBird, go to your profile, open the Mail subfolder, and then open the subfolder under that for your email account.

• If you need help finding your profile files, see Where is my Profile Folder. WinXP users be sure to read the part about revealing hidden files and not hiding file extensions.

Find the message file for the mail folder in question (file with same name as message folder displayed in TBird, with no filename extension, so the file for your Inbox would just be called "Inbox"). For safety's sake make a backup copy of this file so you can restore it later if you make a mistake. Now open the file in a plain text editor.

• Do NOT use a word processor like MSWord.
• Windows NotePad will work for smaller files that it can load
• Windows WordPad can handle larger files.

You should be able to see the content of the file and scroll up/down from message to message.

Note that each email begins with a series of headers, perhaps quite a few of them. Locate the X-Mozilla-Status: XXXX header for a few of them. The numerical value here is a hexadecimal "bit map" that contains a fair amount of information about the message.

Some common hexadecimal values for these settings would be:

0000 - nothing marked, i.e. received only
0001 - message has been read
0002 - message has been replied to
0004 - you have set a flag on this message
0008 - message inactive (i.e. deleted or moved to another folder)
0010 - was a reply with RE: at the beginning of subject line
1000 - forwarded

(There are a few less common ones as well, see http://www.eyrich-net.org/mozilla/X-Mozilla-Status.html if interested.)

When more than one of these applies, the values are added together. Thus a message that has been read, replied to, and deleted would have a value of 1 (read) + 2 (replied) + 8 (deleted) = 11(decimal) = b(hex), so the value in X-Mozilla-Status would be 000b.

When a message has been marked as deleted, it will have had 8hex added to the value. If the last digit shown is less than 8, the message has NOT been marked as deleted. (If the last digit is a letter, this is the hex representation for a value from decimal 10 to 15 and so is indeed greater than 8.)

For any deleted message that you want to recover, you just need to UNdelete it. To undelete, edit the X-Mozilla-Status header and subtract 8(hex) from the value.

If you're not familiar with hexadecimal, just use this table for the last digit:

0 to 7 -- leave alone, the message is not marked as deleted
8 change to 0
9 change to 1
a change to 2
b change to 3
c change to 4
d change to 5
e change to 6
f change to 7

Or if you don't want to go to the trouble of messing with all this hexadecimal stuff, just set the last digit to 0 (or the whole thing to 0000) - you'll lose any information about whether the message has been read, replied to, etc. but it at least it should then be undeleted. (Frequent poster Freee!! has made a utility called Thunderbird Reset Status to reset X-Mozilla Status value to 0000 for all messages in the file. http://apveening.a61.nl/software/tbrststs.zip)

Repeat with any additional messages you wish to undelete. Save the file under its original filename and location.

IMPORTANT - while in your profile files, delete the index file for that mail folder (file with the same name as the one you were just editing, plus a *.msf filename extension).

Now start TBird up again. It may take a few seconds for it to rebuild the missing .msf file but your undeleted messages should be available when it is finished.

[makaiguy]

Oh, and the reason the message was deleted in the first place is that you cannot edit the text of a message while you are reading it. You can highlight text and copy it, but if you hit the Delete button while reading a message, it doesn't delete the text, it just deletes the message. I've been caught by this more than one time myself.

[shirschberg]

Thanks for your replys.

I found it. it was located in the trash within the user profile. I'm not sure why I could find it there and not in the regular Trash Folder.