Massive Improper Deletion of Email

M

mayall

Version: 2008
Operating System: Mac OS X 10.5 (Leopard)
Processor: Intel
Email Client: Exchange

This post describes an problem where thousands of emails were deleted from a user's account. this message was cross-posted to the Kerio mailserver support board. The post is rather long in order to try to completely describe the events in the hope that it will help track down the cause and perhaps help someone with a similar problem.

This is not the first time the user has had problems where 1,000s of messages have "disappeared." I have been unable to find a cause or to even determine what software is causing the problem. I do not think it is a "user" error.

Server setup:
- Xserve G5
- Mac OS X Server 10.4.11
- Kerio Mailserver 6.5.2

Client setup:
- MacBook
- Mac OS X 10.5.5
- Entourage 2008 12.1.2
- Exchange account
- 9GB of data
- 10's of thousands of messages

Let me provide a personal caveat that I was away from the office when the following happened and wasn't able to provide normal support to manage the issue.

The problem:

- The user started getting error messages from Entourage that his database was damaged and to rebuild. After ignoring the messages for a couple days, he rebuilt the Entourage database.

- When the user opened the rebuilt Entourage database, he discovered that all the messages in some folders were gone. Viewing the same folders via the Kerio webmail interface showed the same result.

The recovery:

- I started recovering messages from the last Kerio server backup. Note: This is a long and tedious process.

- I discovered that the backup had been failing for over a week because a message on the server that was in the user's account could not be copied to the backup. I therefore had an incomplete backup to work with.

- After recovering from the backup, I restored the user's deleted messages. This moves those messages into the user's Deleted Items folder.

- Restoring the deleted messages did recover the messages that had not been backed up. But the recovery into the Deleted Items folder leaves you with the huge task of organizing the 1,000s of messages. Thankfully, I have an Entourage script to delete duplicate messages.

- After about 16 hours of work, the user's account is close to recovered. When dealing with this many messages, it is impossible to know if you've really recovered them all.

- One odd aspect of the recovery is that there are now duplicate calendar events in webmail that do not show up in Entourage.

- In trying to determine a cause and fix, I called Kerio support. Although knowledgeable and polite, there was not much they could offer. I was told to make sure that users had SSL turned on. I have been lax about this setting and the user did not have SSL turned on. I was given the explanation that SSL can help prevent communication errors between the email client and the server.

- Kerio support suggested that I upgrade to 6.6.0rc2 which I did. This seems to be an extremely nice upgrade -- especially for iPhone users. There is also a new log that would probably offered clues as to the culprit. The log appears to track every client/server transaction.

Epilogue

This has been very frustrating for the user and for me. The user is obviously unhappy that our mail system appears extremely unstable, as am I. I am especially frustrated that I cannot pin down a cause much less a fix.

The obvious suspect is Entourage. I have a very long history with Entourage and, although it has much going for it, stability is not one of its strong points. The fact that large Entourage databases need to be rebuilt on a semi-regular basis does not give one confidence.

To anyone facing a similar situation (a corrupt Entourage database), I suggest that you coach users to not rebuild the database. Instead, they should create a new Entourage identity and download the entire account from the server. There are obviously issues with this approach, like losing message categorization, but this is much better than losing thousands of messages.

Will Mayall
 
D

Diane Ross

- The user started getting error messages from Entourage that his database was
damaged and to rebuild. After ignoring the messages for a couple days, he
rebuilt the Entourage database.

- When the user opened the rebuilt Entourage database, he discovered that all
the messages in some folders were gone.

Rebuilding is a process that can lead to loss of data. A lot depends on the
size of the hard drive, the size of the database and the level of
corruption.

I suspect the database did not even need to be rebuilt. For Exchange users,
we recommend just creating a new Identity in Entourage rather than trying to
rebuild.

If you have problems with the rebuild and something strange happens to your
messages then those changes could synchronize to your Exchange Server.

Even though Entourage makes a copy of the database during the rebuild, I
always recommend that you have a backup copy. Sometimes during the rebuild,
things go wrong and data is lost. Having the backup is critical when this
happens.

Hope this helps!
 
M

mayall

Diane, thanks for the response.

Yes, my general strategy is to create a new account to read the data from the server. I will say that this also once caused lots of problems but I think that is in the past.

In this case, the user simply got tired of dismissing the rebuild dialog and clicked OK. This is understandable and I think the Entourage db check and rebuild process should be rethought.

I've asked the users I support to turn off background db checking so that they do not get the warning messages. Unfortunately, this setting is obscure and hidden away in the Database Utility.

Again, thanks for your help.

Will Mayall
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top