How to find and undelete mail

[Beadmaster]

I've been going back and forth between two computers. I thought I was on the one, so I started typing. Whatever I typed apparently deleted the email that was in front of me...HOWEVER, it is not in the trash!

This isn't the first time I've been unable to find a message and I suspect this is a similar thing that happened before. The problem is I'm in the middle of doing something important, so I can't just not find this email, but no clue at all where it's gone. The first time it happened I fell asleep at the keyboard and I'm guessing now I typed something, because a thorough search of the system did not find the message. Wherever it went, it was gone for good!

So I need to know 1) how to bring back a message that I haven't got the first CLUE how it was deleted to the point where it's not in the trash and is nowhere to be found in a search, and 2) how to set whatever it is that it doesn't happen again.

I have nowhere to search for the information I need right this minute, so this is rather frustrating. This is so inconvenient. WHY is there such a "feature" that deletes messages when the "wrong" thing is typed, and worse than deleting them, it takes them off of the system ENTIRELY?

Thank you in advance. Apologies for my frustration.

[DanRaisch]

Wherever it went, it was gone for good!

Maybe. Maybe not. How is the account set up in Thunderbird, as POP or IMAP? Find out using menu path Tools->Account Settings->Server Settings->Server Type at the top right of the dialogue.

WHY is there such a "feature" that deletes messages when the "wrong" thing is typed,

Because it is a desired feature for some users. The likely cause is simply holding down the Shift key while pressing the D or Del key, something you might easily have done if you were starting a new sentence and that included a capital D. That tells Thunderbird to delete a message (perhaps spam or other undesired message) without placing a copy in the Trash folder.

[makaiguy]

I've done this myself by attempting to edit text when READING an email. When not actually in a COMPOSE window the Del key (or its Ctrl-D shortcut) will delete the message. As mentioned above, Shift-Del will delete without putting a copy in Trash (although on my system at least, Shift-Ctrl-D doesn't do this). And if you had clicked the "Do not ask me again" box on a previous Shift-Del, it won't even show you a warning dialog. If you catch this deletion immediately, you should be able to restore the message via Edit | Undo Delete Message (or its Ctrl-Z shortcut), but once something else has been placed in your computer's clipboard, it's too late.

[DanRaisch]

If that account is set up to access the server via the POP email protocol, this procedure may be helpful to you --
Try to manually recover the message:

* - Do NOT compact the message folders
* - Turn off Thunderbird
* - Navigate to the profile folder ( http://kb.mozillazine.org/Profile_folder_-_Thunderbird )
* - Locate the file containing the message (same name as the folder in Thunderbird, no extension) in your profile
That is, if the message disappeared from the Inbox folder, look for the file Inbox, with no file name extension
* - Delete the file with the same name and the extension .msf
That is, if the message disappeared from the Inbox folder, look for the file Inbox.msf.
* - Open the file without extension with Notepad (or another text editor)
* - Locate the messages that were unintentionally deleted by finding the subject, date/time, or body contents
* - Change the status (X-Mozilla-Status) to all zero
* - Save that file
* - Restart Thunderbird

[Beadmaster]

Thanks everyone! I'll check it out. I'm on POP email. I'm not sure what happened. I typed one very dangerous word, in all lowercase: bead. LOL. So I'm not sure why it saw it as a shift-D.

I'll try the profile folder option, Dan. Thanks! While I don't need the message at this time now (took care of the problem in a different way) it may come in handy, so I'd like to get it back for future use.

Thanks again, all! Have a fantastic holiday!

[makaiguy]

More detailed undelete info:

What follows assumes that this is a POP3 mail account (or that you have saved messages from an IMAP account locally in your Local Folders), that you have previously downloaded all the missing messages to the TBird installation on your computer, and that you deleted them from there.

If you have not yet compacted your folders, your deleted messages should still be in your profile where they can be recovered. Do NOT compact your folders until we get through this.

This will take some effort but it can be done.

Exit TBird, go to your profile, open the Mail subfolder, and then open the subfolder under that for your email account.

• If you need help finding your profile files, click Help in the menu bar, then Troubleshooting Information, and click the Show Folder button.

Find the message file for the mail folder in question (file with same name as message folder displayed in TBird, with no filename extension, so the file for your Inbox would just be called "Inbox"). For safety's sake make a backup copy of this file so you can restore it later if you make a mistake. Now open the file in a plain text editor.

• Do NOT use a word processor like MSWord.
• Windows NotePad will work for smaller files that it can load
• Windows WordPad can handle larger files.

This file contains all the messages in that folder, one right after another. You should be able to see the content of the file and scroll up/down from message to message.

Note that each email begins with a series of headers, perhaps quite a few of them. Locate the X-Mozilla-Status: XXXX header for a few of them. The numerical value here is a hexadecimal "bit map" that contains a fair amount of information about the message.

Some common hexadecimal values for these settings would be:

• 0000 - nothing marked, i.e. received only
  0001 - message has been read
  0002 - message has been replied to
  0004 - you have set a flag on this message
  0008 - message inactive (i.e. deleted or moved to another folder)
  0010 - was a reply with RE: at the beginning of subject line
  1000 - forwarded

When more than one of these applies, the values are added together. Thus a message that has been read, replied to, and deleted would have a value of 1 (read) + 2 (replied) + 8 (deleted) = 11(decimal) = b(hex), so the value in X-Mozilla-Status would be 000b.

When a message has been marked as deleted, it will have had 8hex added to the value. If the last digit shown is less than 8, the message has NOT been marked as deleted. (If the last digit is a letter, this is the hex representation for a value from decimal 10 to 15 and so is indeed greater than 8.)

For any deleted message that you want to recover, you just need to UNdelete it. To undelete, edit the X-Mozilla-Status header and subtract 8(hex) from the value.

If you're not familiar with hexadecimal, just use this table for the last digit:

• 0 to 7 -- leave alone, the message is not marked as deleted
  8 change to 0
  9 change to 1
  a change to 2
  b change to 3
  c change to 4
  d change to 5
  e change to 6
  f change to 7

Or if you don't want to go to the trouble of messing with all this hexadecimal stuff, just set the last digit to 0 (or the whole thing to 0000) - you'll lose any information about whether the message has been read, replied to, etc. but it at least it should then be undeleted. (Frequent poster Kaosmos has made a utility called Thunderbird Reset Status to reset X-Mozilla Status value to 0000 for ALL messages in the file. https://freeshell.de//~kaosmos/index-en.html#recDelMsg)

Repeat with any additional messages you wish to undelete. Save the file under its original filename and location.

IMPORTANT - while in your profile files, delete the index file for that mail folder (file with the same name as the one you were just editing, plus a *.msf filename extension).

Repeat the whole process for any additional folders.

Start TBird up again. It may take a few seconds for it to rebuild the missing .msf file but your undeleted messages should be available when it is finished.