There is no audit trail of who did what when.

If the messages were the most recent deletions, i.e. additions to the Trash folder, you could check the date of the Trash mbox file in the profile folder to see the date and time of the latest modification. Otherwise you'd have to enlist the aid of the mail provider to possibly track the activity.

There is no audit trail of who did what when.

Tell me where I can find the audit trail.

If the messages were the most recent deletions, i.e. additions to the Trash folder, you could check the date of the Trash mbox file in the profile folder to see the date and time of the latest modification. Otherwise you'd have to enlist the aid of the mail provider to possibly track the activity.

You meant the directory: C:\Users\xyz\AppData\Roaming\Thunderbird\Profiles\xyz.default-release\ImapMail\serverxyz.nazwa.pl\INBOX.sbd

It contains the following files: Trash.msf, Trash ? The date of their last modification is "overwritten" by subsequent files that went to the trash, and in the content of these files there are no logs or trace of when changes were made. I think so! Maybe there's something hidden in the code? If you know what it is, I will be grateful for the hint.

Matt powiedział

There is no audit trail of who did what when.

Tell me where I can find the audit trail.

You mail provider might have logs of what what changed and when. But it is not something that Thunderbird retains anywhere.

I've looked through most of the options and, apart from the support of the mail server service provider, who is the only one who has logs, I only have one idea (I don't know if he'll share them with me): 1. I only have two messages thrown into the trash after the one I care about the most. 2. I tested on another computer that when deleting an e-mail from inbox, it "virtually" immediately transfers its code to the trash file and overwrites it with a millisecond delay. 3. I will try to recover three overwritten files with a data recovery program and if, after reviewing them, I find the code of the e-mail I am looking for, I will check the original saving time and date of this file. 4. If I succeed, I will correlate it with the camera recordings and catch this nasty troll and terrorist mole :)

I will let you know what I managed to do in this case and which concept failed.