Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

How to check the date and time an email was deleted?

more options

Hi. We have a few interns at work and I think there's a troll. Just before Christmas, he deleted important emails and the whole team was hurt. We only got paid after Christmas. I found the emails in the folder: Trash (Thunderbird), but I don't know how to check when exactly they were deleted. If I had a day and an hour, we would have caught him on surveillance.

Hi. We have a few interns at work and I think there's a troll. Just before Christmas, he deleted important emails and the whole team was hurt. We only got paid after Christmas. I found the emails in the folder: Trash (Thunderbird), but I don't know how to check when exactly they were deleted. If I had a day and an hour, we would have caught him on surveillance.

All Replies (6)

more options

There is no audit trail of who did what when.

more options

If the messages were the most recent deletions, i.e. additions to the Trash folder, you could check the date of the Trash mbox file in the profile folder to see the date and time of the latest modification. Otherwise you'd have to enlist the aid of the mail provider to possibly track the activity.

more options

Matt powiedział

There is no audit trail of who did what when.

Tell me where I can find the audit trail.

more options

sfhowes powiedział

If the messages were the most recent deletions, i.e. additions to the Trash folder, you could check the date of the Trash mbox file in the profile folder to see the date and time of the latest modification. Otherwise you'd have to enlist the aid of the mail provider to possibly track the activity.

You meant the directory: C:\Users\xyz\AppData\Roaming\Thunderbird\Profiles\xyz.default-release\ImapMail\serverxyz.nazwa.pl\INBOX.sbd

It contains the following files: Trash.msf, Trash ? The date of their last modification is "overwritten" by subsequent files that went to the trash, and in the content of these files there are no logs or trace of when changes were made. I think so! Maybe there's something hidden in the code? If you know what it is, I will be grateful for the hint.

more options

Wojciech Magdziak vel Wierzbicki (WojTECH) said

Matt powiedział

There is no audit trail of who did what when.

Tell me where I can find the audit trail.

You mail provider might have logs of what what changed and when. But it is not something that Thunderbird retains anywhere.

more options

I've looked through most of the options and, apart from the support of the mail server service provider, who is the only one who has logs, I only have one idea (I don't know if he'll share them with me): 1. I only have two messages thrown into the trash after the one I care about the most. 2. I tested on another computer that when deleting an e-mail from inbox, it "virtually" immediately transfers its code to the trash file and overwrites it with a millisecond delay. 3. I will try to recover three overwritten files with a data recovery program and if, after reviewing them, I find the code of the e-mail I am looking for, I will check the original saving time and date of this file. 4. If I succeed, I will correlate it with the camera recordings and catch this nasty troll and terrorist mole :)

I will let you know what I managed to do in this case and which concept failed.

Modified by Wojciech Magdziak vel Wierzbicki (WojTECH)