Link to home
Get AccessLog in
Avatar of IT Man200
IT Man200

asked on

Macmail lost / deleted a big chunk of my gmail - apparenlty unrecoverable. Using Timemachine backup instead.

Hi,

We have a user who somehow has managed to delete massive amounts of email from her MacMail which was connected to her Gmail account. They did not seem to be in trash and panicking the user done things like “Rebuild” from Macmail.

On the same day we contact Gmail expecting them to have some fail safe as documentation indicates all email is kept for 30 days. However, they have responded to our support request saying the email has been permanently  deleted.

This has caused some distress and we can’t believe it. We offered to pay Google. We are awaiting a response but are not hopeful.

The good news for the use is that they do have a time machine backup from two days ago! This is great because we can in theory restore this to another computer, make sure that computer is not connected to the internet and then then make a backup of the mailbox with the view to restore it to Gmail.

My questions are around establishing what the safest way of achieving this is. Therefore:

1)      Is it OK to take what is a backup of a recent MacBook, and restore this to our 2 year old Macmini in the office?
2)      Does anyone know if there is any actual method of recovering emails from Gmail – I assume the user pressed ctrl delete to bypass moving to trash?
3)      Assuming success at restore the time machine backup to another Macmini, what is a safe way to export the emails from MacMail and then import them to Gmail.

I just want to be 100% sure I do this perfect as there is no other backup so this will be the only chance to recovering the email (unless Google do confirm a method)

Thanks in advance.
Avatar of Scott C
Scott C
Flag of United States of America image

With how this reads, I'd say Google can't help you.  The emails aren't in the trash and somebody else didn't access the mailbox.

https://support.google.com/mail/answer/78353?hl=en
ASKER CERTIFIED SOLUTION
Avatar of strung
strung
Flag of Canada image

Link to home
membership
This content is only available to members.
To access this content, you must be a member of Experts Exchange.
Get Access
Avatar of IT Man200
IT Man200

ASKER

OK. I've got all the bits. I restored the timemachine backup to the most recent backup on another Mac, and the most recent backup does not seem to have the emails either.

I'm going to go back further.
My question now is, can I attach the hard drive, to Mac with the recovered partition, and just about different versions. E.g. Can I go back a week, but then go forward again and not risk any of the data on the hard drive with the original timemachine backup.

Basically I'm scared of ruining the original back.
SOLUTION
Link to home
membership
This content is only available to members.
To access this content, you must be a member of Experts Exchange.
Get Access
OK. I'm going to take your advice more to the letter. I was a bit scared, hence I thought to a full recovery to another computer.

At time of writing that occurring to an earlier version, but once it's completed, I'll attach the backup drive to the original Mac Air.

One more question, when you start the advice, you say

open the folder:  ~/library/Mail/V2 in Finder.

So this of course (and it's obvious as I type it, but I'll still ask) this is on the original MacAir in it's current mode.

Then the harddirve attached to the original MacAir and time machine will have some way of just looking at the previous versions of the file?

Remember,  I don't really use Mac's. Normally I would not be the one working on this, but because it's a weekend one, I'm having to do Mac stuff. It's mostly easy to work out, but I'm being extra cautious. hence thought recovering to another computer would be a safer approach. Then I should just export the emails from there without touching the original MacAir.

But your advise seems excellent so thanks so far!!
SOLUTION
Link to home
membership
This content is only available to members.
To access this content, you must be a member of Experts Exchange.
Get Access
Hi, Note on the system I'm looking at, there is no Mail folder
Just Library, and lots of folders but no mail folder inside?
Any ideas?
Yes. You are looking in the wrong Library folder.

You need to go to Macintosh HD/users/Username/Library/
Is there hidden folders on Mac. I don't be able to see Library under the username folder?
Or click on the Home icon in the sidebar of a finder window and then go to the library folder.

OR:

Click on the desktop to make sure you are in Finder, the pull down the GOmenu to GO TO FOLDER and copy and paste the following line into the box and hit return:

~/library/Mail/V2
It might be hidden if it is an older version of the OS. In that case, this should work:

Click on the desktop to make sure you are in Finder, the pull down the GOmenu to GO TO FOLDER and copy and paste the following line into the box and hit return:

~/library/Mail/V2
If that doesn't work, you can make the ~/library folder visible as follows:

Open Terminal.app (found in /Applications/Utilities)

copy and paste the following line into the terminal window and hit return:

chflags nohidden ~/Library
OK found it using the Go To option. Checking things out now.
There are a lot of mbox folders. Is there anyway of seeing all the sizes of them at once?
You only need to look at the GMAIL ones. Presumably it was the inbox stuff that the client deleted, so if you just check the inbox file each time until you get to one that is much bigger, that should probably do it. Probably the only two that you need to recover the Inbox and Sent.
The "finder" in Time Machine doesn't show the file sizes as the regular finder does, because it would be too slow over a network.
Hmmm Sadly not. The issue was that all their sub folders, of which there were many, significantly emptied.

There is a part of me which is trying to work out, how they achieved this?

Is it something to do with the way Gmail just tags emails, rather than moving to actual folders? Not expecting you to know but just in case.
I think what you have to do is this:

Go back through checking only the mailbox that you think is the one most depleted until you get to the date where it is significantly larger.

Make a note of that date. Call it Date A.

Then close out Time Machine.

Back in Finder, back out to the V2 folder. Then go back into Time Machine and go to Date A and restore the entire Gmail folder for that day by right-clicking and choosing Restore [Folder] to...

That should restore the entire folder and all the mailboxes it contains.
I am going out for an hour or so. Good luck
OK. Out of interest, I already restored an old version of the entire V2 Folder.
If I simply renames the current live v2 folder to
v2-old
and then copied in the one I recovered, would this work?

Any risk in this approach?
I don't get this. Why is the restored version of the "v2" folder smaller than the current one!

3.4GB compared to 1.2GB of the restored.

Something very strange going on and not helped by my weakness on Mac.
The restored folder won't have any mail newer than its restore point, but I wouldn't think that would account for that many gigs.

Does the old version have all the same subfolders and mailboxes as the old one?

I wouldn't risk trying to replace the new V2 with the old one. The safer route is to import the mailboxes from the older V2 into Mail using the Mail import function.
When you say you "already restored an old version of the entire V2 Folder", exactly how did you do that? How old was the restored V2 folder?
OK. Too late regarding the V2 folder. I renamed it and then put the other one in

As for restoring the older verion.
I used time machine  to restore the entire V2 folder to a different location

I then renatemd the original V2 folder to v2-originaal
I put the one I restored to the location of where the original V2 folder was, and then started the Mail application
It did say the email was from an older version and needed to be imported. It imported about 30k items, however I still can't find 30000 emails.


I'm not thinking of going back to the original V2 folder by swapping them back.

Any thoughts on all this. I did try and follow some of your original instructions but seemed to get different results. So applied my own knowledge to improvised based on my experience in the windows world.
How did you decide what date to choose when you restored the V2 folder?

I think you have to put the original one back, and then use the method I mention in my earlier post to find mailboxes BIGGER than the current versions.
The strange thing is, when in Timemachine, the previous version, did show as being a bit bigger.
 But when recovered, it's much smaller.
So in timemachine it showed as about 4gb
once recovered and then opened with Macmail it was about 1.5GB.
I will repeat this process and make sure that at time of recovery, BEFORE opening in Macmail, that It is still 4GB.
All I know is that I'm very confused, and I'm going back to this in about 1.5 hours time

Thanks for all your input. I hope I crack this tonight.
SOLUTION
Link to home
membership
This content is only available to members.
To access this content, you must be a member of Experts Exchange.
Get Access
Yes for sure. Gmail via web was checked and all the email was gone.
The status is at the moment, even in Time Machine, going back, I can't find the emails.

When I take an old V2 folder which is bigger then the current one, say 4.5GB.

I put in place of the current live one. Mac Mail reports an import process occurring as, I cant' remember exact wording, but something about a new version.

It says about 33000 items are imported,

However, by time it's done there are not 33000 emails. Far from that amount and also far from an amount that one would think is 4.5GB.
Any other suggestions?
Don' t put it in place of the current live one. Put it elsewhere and in Mail choose File > Import Mailboxes and import the individual mailboxes. Leave the live V2 where it is.
SOLUTION
Link to home
membership
This content is only available to members.
To access this content, you must be a member of Experts Exchange.
Get Access
At present I've been trying to do mbox imports of fodlers, but it always reports

"error
No valid mbox files were found
"

I'm back on this case picking up more tomorrow and maybe I should consolidate the two open questions I have, but appreciate further input.
Thanks
For more on this case, please see separate posting

https://www.experts-exchange.com/questions/28806399/Recovering-lost-emails-from-Macmail-and-Mbox-files.html 

This is where the case is being consolidated into. Thanks
Problem still not solved, but case close and linked to new case and points awarded for input on  this matter.

Many thanks