Macmail lost / deleted a big chunk of my gmail - apparenlty unrecoverable. Using Timemachine backup instead.

Hi,

We have a user who somehow has managed to delete massive amounts of email from her MacMail which was connected to her Gmail account. They did not seem to be in trash and panicking the user done things like “Rebuild” from Macmail.

On the same day we contact Gmail expecting them to have some fail safe as documentation indicates all email is kept for 30 days. However, they have responded to our support request saying the email has been permanently  deleted.

This has caused some distress and we can’t believe it. We offered to pay Google. We are awaiting a response but are not hopeful.

The good news for the use is that they do have a time machine backup from two days ago! This is great because we can in theory restore this to another computer, make sure that computer is not connected to the internet and then then make a backup of the mailbox with the view to restore it to Gmail.

My questions are around establishing what the safest way of achieving this is. Therefore:

1)      Is it OK to take what is a backup of a recent MacBook, and restore this to our 2 year old Macmini in the office?
2)      Does anyone know if there is any actual method of recovering emails from Gmail – I assume the user pressed ctrl delete to bypass moving to trash?
3)      Assuming success at restore the time machine backup to another Macmini, what is a safe way to export the emails from MacMail and then import them to Gmail.

I just want to be 100% sure I do this perfect as there is no other backup so this will be the only chance to recovering the email (unless Google do confirm a method)

Thanks in advance.
IT Man200Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Scott CSenior EngineerCommented:
With how this reads, I'd say Google can't help you.  The emails aren't in the trash and somebody else didn't access the mailbox.

https://support.google.com/mail/answer/78353?hl=en
strungCommented:
I think all you have to to is open the folder:  ~/library/Mail/V2 in Finder. This is where the mailbox data is stored.

Then open Time Machine and go back to the last backup before the user deleted the Mailboxes.

Ask Time Machine to restore the mailbox files for the Gmail account in question. It will ask you where to restore them so you don't overwrite the existing files.

Then open mail and use the Import function to import the recovered mail boxes.

Then copy the mail from the recovered mailboxes back to the Gmail inbox and that should copy it back to the Gmail mail server.

https://support.apple.com/kb/PH19174?locale=en_US

See also:  http://www.macissues.com/2014/12/07/how-to-manually-restore-your-mail-folder-from-time-machine/

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
IT Man200Author Commented:
OK. I've got all the bits. I restored the timemachine backup to the most recent backup on another Mac, and the most recent backup does not seem to have the emails either.

I'm going to go back further.
My question now is, can I attach the hard drive, to Mac with the recovered partition, and just about different versions. E.g. Can I go back a week, but then go forward again and not risk any of the data on the hard drive with the original timemachine backup.

Basically I'm scared of ruining the original back.
IT Pros Agree: AI and Machine Learning Key

We’d all like to think our company’s data is well protected, but when you ask IT professionals they admit the data probably is not as safe as it could be.

strungCommented:
As per my previous suggestion, open the folder:  ~/library/Mail/V2 in Finder. This is where the mailbox data is stored. Inside there you should find a folder for the specific Gmail account. It will have a name like IMAP-username@imap.gmail. Open the folder and note the size of the mailbox files. Write these down on a sheet of paper.

Create a "recovered items" folder on the desktop.

Then open Time Machine and go back to the previous back-up. Click on the inbox and select GetInfo. This will give you the size of the mailbox on the backup. If it is not significantly larger than the current version, you have not gone back far enough.

Go back to the next backup and repeat until you find a mail box that is significantly bigger than the current one. Presumably it has the deleted items, but to be safe you might go back one further in case your client deleted mail more than once.

Once you are satisfied you have the right mail box, right-click on it and choose "Restore ... to..." and restore the mailbox(es) to the recovered items folder you earlier created.

Then you can import the recovered mailboxes into Mail (into a new mailbox) and copy the e-mails back to the Gmail mailbox, which will copy them back to the gmail server.

You DO NOT need to recover the whole drive to an external.
IT Man200Author Commented:
OK. I'm going to take your advice more to the letter. I was a bit scared, hence I thought to a full recovery to another computer.

At time of writing that occurring to an earlier version, but once it's completed, I'll attach the backup drive to the original Mac Air.

One more question, when you start the advice, you say

open the folder:  ~/library/Mail/V2 in Finder.

So this of course (and it's obvious as I type it, but I'll still ask) this is on the original MacAir in it's current mode.

Then the harddirve attached to the original MacAir and time machine will have some way of just looking at the previous versions of the file?

Remember,  I don't really use Mac's. Normally I would not be the one working on this, but because it's a weekend one, I'm having to do Mac stuff. It's mostly easy to work out, but I'm being extra cautious. hence thought recovering to another computer would be a safer approach. Then I should just export the emails from there without touching the original MacAir.

But your advise seems excellent so thanks so far!!
strungCommented:
Yes. Restore from the original Mac.

By the way the tilde (~) in the path name is short for the user's home folder. The mail is stored in the library folder in the user's home folder, not the library folder at the root of the hard drive.

The way you look at previous version is to drag down the Time Machine icon in the menubar to Enter Time Machine. A new version of the desktop will appear with only the folder you were in when you enacted time machine. There are arrow keys to allow you to go back one backup at a time, or a time line at the right to go back to a specific date.

See for instance this article:  http://www.techrepublic.com/article/pro-tip-how-to-recover-files-using-time-machine-including-email/

However, instead of hitting the "restore" button as suggested in the article, right-click on the file and choose "restore [filename] to...] to save it to the recovered items folder.

There is a video here too:  https://www.youtube.com/watch?v=fes93NW_KE0
IT Man200Author Commented:
Hi, Note on the system I'm looking at, there is no Mail folder
Just Library, and lots of folders but no mail folder inside?
Any ideas?
strungCommented:
Yes. You are looking in the wrong Library folder.

You need to go to Macintosh HD/users/Username/Library/
IT Man200Author Commented:
Is there hidden folders on Mac. I don't be able to see Library under the username folder?
strungCommented:
Or click on the Home icon in the sidebar of a finder window and then go to the library folder.

OR:

Click on the desktop to make sure you are in Finder, the pull down the GOmenu to GO TO FOLDER and copy and paste the following line into the box and hit return:

~/library/Mail/V2
strungCommented:
It might be hidden if it is an older version of the OS. In that case, this should work:

Click on the desktop to make sure you are in Finder, the pull down the GOmenu to GO TO FOLDER and copy and paste the following line into the box and hit return:

~/library/Mail/V2
strungCommented:
If that doesn't work, you can make the ~/library folder visible as follows:

Open Terminal.app (found in /Applications/Utilities)

copy and paste the following line into the terminal window and hit return:

chflags nohidden ~/Library
IT Man200Author Commented:
OK found it using the Go To option. Checking things out now.
IT Man200Author Commented:
There are a lot of mbox folders. Is there anyway of seeing all the sizes of them at once?
strungCommented:
You only need to look at the GMAIL ones. Presumably it was the inbox stuff that the client deleted, so if you just check the inbox file each time until you get to one that is much bigger, that should probably do it. Probably the only two that you need to recover the Inbox and Sent.
strungCommented:
The "finder" in Time Machine doesn't show the file sizes as the regular finder does, because it would be too slow over a network.
IT Man200Author Commented:
Hmmm Sadly not. The issue was that all their sub folders, of which there were many, significantly emptied.

There is a part of me which is trying to work out, how they achieved this?

Is it something to do with the way Gmail just tags emails, rather than moving to actual folders? Not expecting you to know but just in case.
strungCommented:
I think what you have to do is this:

Go back through checking only the mailbox that you think is the one most depleted until you get to the date where it is significantly larger.

Make a note of that date. Call it Date A.

Then close out Time Machine.

Back in Finder, back out to the V2 folder. Then go back into Time Machine and go to Date A and restore the entire Gmail folder for that day by right-clicking and choosing Restore [Folder] to...

That should restore the entire folder and all the mailboxes it contains.
strungCommented:
I am going out for an hour or so. Good luck
IT Man200Author Commented:
OK. Out of interest, I already restored an old version of the entire V2 Folder.
If I simply renames the current live v2 folder to
v2-old
and then copied in the one I recovered, would this work?

Any risk in this approach?
IT Man200Author Commented:
I don't get this. Why is the restored version of the "v2" folder smaller than the current one!

3.4GB compared to 1.2GB of the restored.

Something very strange going on and not helped by my weakness on Mac.
strungCommented:
The restored folder won't have any mail newer than its restore point, but I wouldn't think that would account for that many gigs.

Does the old version have all the same subfolders and mailboxes as the old one?

I wouldn't risk trying to replace the new V2 with the old one. The safer route is to import the mailboxes from the older V2 into Mail using the Mail import function.
strungCommented:
When you say you "already restored an old version of the entire V2 Folder", exactly how did you do that? How old was the restored V2 folder?
IT Man200Author Commented:
OK. Too late regarding the V2 folder. I renamed it and then put the other one in

As for restoring the older verion.
I used time machine  to restore the entire V2 folder to a different location

I then renatemd the original V2 folder to v2-originaal
I put the one I restored to the location of where the original V2 folder was, and then started the Mail application
It did say the email was from an older version and needed to be imported. It imported about 30k items, however I still can't find 30000 emails.


I'm not thinking of going back to the original V2 folder by swapping them back.

Any thoughts on all this. I did try and follow some of your original instructions but seemed to get different results. So applied my own knowledge to improvised based on my experience in the windows world.
strungCommented:
How did you decide what date to choose when you restored the V2 folder?

I think you have to put the original one back, and then use the method I mention in my earlier post to find mailboxes BIGGER than the current versions.
IT Man200Author Commented:
The strange thing is, when in Timemachine, the previous version, did show as being a bit bigger.
 But when recovered, it's much smaller.
So in timemachine it showed as about 4gb
once recovered and then opened with Macmail it was about 1.5GB.
I will repeat this process and make sure that at time of recovery, BEFORE opening in Macmail, that It is still 4GB.
All I know is that I'm very confused, and I'm going back to this in about 1.5 hours time

Thanks for all your input. I hope I crack this tonight.
serialbandCommented:
Some Mac Folders are generally "hidden" to the average user.  It's always visible from the command line.  You can use the open command to open any folder you see in Terminal.app in the Finder gui.  You can also use the Go --> Go To Folder (Shift Command G) menu in Finder to manually enter the folder.  I find it easier to do from the command line.  This should be unix commands.

The command to check folder and file sizes in Terminal.app is du.

The mail folder follows the following format.
cd ~/Library/Mail/V2/IMAP-username@gmail.com

If you want to open the folder in the finder, then
open  ~/Library/Mail/V2/IMAP-username@gmail.com
or
open  ~/Library/Mail/V2


The tilde (~) will expand to the current user's home folder, usually in /Users/USERNAME/

To show the size of the current folder
du -sh

To show just the Inbox
du -sh Inbox.mbox

To show the size of all folders in the current folder
du -sh *

It's entirely possible that some mail content has a sequence that is causing mail to choke and preventing mail from loading.  You can try moving out portions of mail and loading it back.  Be sure you make a copy of the folder if you try this.

I also don't see a specific mention of an attempt to connect to gmail through the web interface.  Was this done to verify that the mail was actually deleted from gmail servers?  It seems implied, but I want to be absolutely sure this was done.
IT Man200Author Commented:
Yes for sure. Gmail via web was checked and all the email was gone.
The status is at the moment, even in Time Machine, going back, I can't find the emails.

When I take an old V2 folder which is bigger then the current one, say 4.5GB.

I put in place of the current live one. Mac Mail reports an import process occurring as, I cant' remember exact wording, but something about a new version.

It says about 33000 items are imported,

However, by time it's done there are not 33000 emails. Far from that amount and also far from an amount that one would think is 4.5GB.
Any other suggestions?
strungCommented:
Don' t put it in place of the current live one. Put it elsewhere and in Mail choose File > Import Mailboxes and import the individual mailboxes. Leave the live V2 where it is.
serialbandCommented:
If you're importing and it doesn't show up, you might just have a badly formatted email that's breaking mail.  You may have to try importing parts of the mail folders instead of all of it.

See if you can import the mail as mbox format.  It's possible that the emlx database is corrupt or shows the mail as deleted, so that the import is causing the actual mail data to be removed.  Mac mail comes in parts.  There's an emlx file with individual mail content and an Info.plist file that points to the root of each folder and a directory structure. This entire mess is to allow Spotlight to search your mail.
You'll have to convert the emlx files to mbox first.  I've found a few free converters, but they seem quite old.
http://www.broobles.com/eml2mbox/
http://www.cosmicsoft.net/emlxconvert.html
http://www.vengefulcow.com/emlx2mbox/
IT Man200Author Commented:
At present I've been trying to do mbox imports of fodlers, but it always reports

"error
No valid mbox files were found
"

I'm back on this case picking up more tomorrow and maybe I should consolidate the two open questions I have, but appreciate further input.
Thanks
IT Man200Author Commented:
For more on this case, please see separate posting

http://www.experts-exchange.com/questions/28806399/Recovering-lost-emails-from-Macmail-and-Mbox-files.html 

This is where the case is being consolidated into. Thanks
IT Man200Author Commented:
Problem still not solved, but case close and linked to new case and points awarded for input on  this matter.

Many thanks
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Mac OS X

From novice to tech pro — start learning today.