All HowTo's Cybersecurity

Restoring emails from backups – Dovecot & Thunderbird

This article discussed the issues and solutions relating to restoring email backups relating to Dovecot and Thunderbird. The assumptions here are that a) you have file-level backups of the emails, and b) those emails are in “Maildir” format. It’s too late to recommend you do backups. I assume you have them otherwise you’re in a whole heap of trouble. Well, not really, you do have the Thunderbird copy of the emails. If that’s you, make backups on each workstation and then get started on repairing your mail server.

Some key details:
1. Dovecot stores emails as individual files but the structure of folders in an email client (such as Thunderbird) don’t make those of the Dovecot filesystem. Dovecot creates a file like “dir1.dir2.myemail”.

2. Keep in mind that some files and directories within the Dovecot directory structure are hidden. If/when you rsync the files form the backup location to the Dovecot server, make sure to include hidden files. Rsync will include hidden files as long as you don’t use “*”. For example, this would work:

mailserver1# rsync backupserver.agix.local:/backups/mailserver1/user1/ /home/user1/

While this would not include hidden files (notice the “*”):

mailserver1# rsync backupserver.agix.local:/backups/mailserver1/user1/* /home/user1/

3. Dovecot keeps a cache of emails in hidden files within each users Maildir root. You can remove them without hassles except that Dovecot will have to automatically rebuild them on next start/restart. This may help when sorting out inconsistencies between the Dovecot server and the mail client.

4. Thunderbird file types to look out for. The first is a single file called “.subscriptions” which holds a record of the directories that Thunderbird has subscribed to. Removing this file will mean you have to manually subscribe to folders again. It may assist with troubleshooting. I’d suggest making a copy of that file first to save time re-subscribing if the issue persists. The second file type is the “*.mfs” file. There will be one for every folder within Thunderbird. This is a cache for the given folder. You can remove it and Thunderbird will re-create it. This may assist with inconsistencies.

5. Before you start restoring email from backups, stop Postfix and Dovecot on the mail server. This will assist until you know what’s going on.

So how to actually do the restore? There are too many possible starting points that it’s hard for me to make a recommendation. Possibly Thunderbird has already started (on one or more workstations) and is now causing issues with lost emails. It’s possible the portable devices are trying to sync with the Dovecot server. I suggest restoring a single users Maildir and once successful (check their Inbox, subfolders and Sent folder) do the others too.

Leave a Reply

Your email address will not be published. Required fields are marked *