Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[~Solved] Thunderbird Inbox file reduced to zero size!
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Unsupported Software
View previous topic :: View next topic  
Author Message
The_Saint
Tux's lil' helper
Tux's lil' helper


Joined: 15 Mar 2004
Posts: 108

PostPosted: Tue May 19, 2009 8:12 am    Post subject: [~Solved] Thunderbird Inbox file reduced to zero size! Reply with quote

I had a very unfortunate moment. My Thunderbird Inbox was flooded and auto-compressed to zero size!!
I lost >3000 e-mails. Is there any way to salvage the previous Inbox file (as it was before the compression)?
I use ext3 file system.
I am currently reading the documentation of foremost. It seems able to recover most common files like jpg, pdf, avi etc, but I have found no way to tell it to search for mbox (i.e. plaintext) files.
Any ideas/suggestions would be most appreciated. In other words: H E L P !!!!!


Last edited by The_Saint on Thu May 21, 2009 12:10 pm; edited 1 time in total
Back to top
View user's profile Send private message
DawgG
l33t
l33t


Joined: 17 Sep 2003
Posts: 812

PostPosted: Tue May 19, 2009 12:31 pm    Post subject: Reply with quote

if the file itself (not what is displayed in thunderbird's window) is zero-size: forget it.
if the file itself has been worked on formost will not be of much help. if you umounted the partition it resided on right after you might be able to recover some fragments of the file with highly professional (==expensive) forensic help.
still: GOOD LUCK


(maybe do a backup next time?)
_________________
DUMM KLICKT GUT.
Back to top
View user's profile Send private message
kernelOfTruth
Watchman
Watchman


Joined: 20 Dec 2005
Posts: 6108
Location: Vienna, Austria; Germany; hello world :)

PostPosted: Tue May 19, 2009 12:42 pm    Post subject: Reply with quote

@DawgG:

Quote:
DUMM KLICKT GUT


nice one :lol:

THE_SAINT:

create an image of your partition with the data with dd (just in case) store it in a secure place and then try to recover files with photorec, testdisk ...
_________________
https://github.com/kernelOfTruth/ZFS-for-SystemRescueCD/tree/ZFS-for-SysRescCD-4.9.0
https://github.com/kernelOfTruth/pulseaudio-equalizer-ladspa

Hardcore Gentoo Linux user since 2004 :D
Back to top
View user's profile Send private message
DawgG
l33t
l33t


Joined: 17 Sep 2003
Posts: 812

PostPosted: Tue May 19, 2009 4:27 pm    Post subject: Reply with quote

creating a dd-image asap cannot hurt. what's the size of the file in the fs?
couple of weeks ago i attended a talk about some forensic progs (testdisk, photorec etc.) and was told that if the file (or its contents) itself is modified there is (almost) no chance of getting (a lot of) it back because the patterns all those progs search for are modified, too.
but still: GOOD LUCK!

@kernelOfTruth
...ain't it the truth? :wink:
_________________
DUMM KLICKT GUT.
Back to top
View user's profile Send private message
The_Saint
Tux's lil' helper
Tux's lil' helper


Joined: 15 Mar 2004
Posts: 108

PostPosted: Thu May 21, 2009 12:09 pm    Post subject: Reply with quote

Many thanks for your replies.

Fortunately, the Foremost software worked OK and I was able to recover about 4GB of my mbox e-mail files (in chunks no larger than 7-8 MB each). I believe some of them are redundant, but I estimate that I rescued more than 50% of the damaged Inbox file. By the way Foremost was awsome; It was even able to recover some chunks from the swap partition as well!! And I learned a lot in the procces.

By the way, just in case you ever happen to be in a similar situation (I hope you never be) the correct line in the foremost.conf file that does the job should read like this:
Code:
     .     y    100000000     X-Mozilla-Status    X-Mozilla-Status     ASCII

Please note that despite what the documentation says, you should not use the keyword NONE if you wish to carve files with no extension. It seems to work fine when you run it with the -w option but in the real scenario it does not build the proper path to save the files and stops with an error message (yes, probably a bug, or an undocumented "feature"). After some experimentation, I found that the dot (.) worked OK instead of NONE.

And yes, I WILL backup my files from now on. I guess I have been over-confident on Thunderbird and I never expected to crash like that due to a few hundred spam mails that overflooded my Inbox :)
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Unsupported Software All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum