Comments on: Recovering deleted emails from Thunderbird

By: Márton Szabó

Márton Szabó — Sat, 16 Jul 2011 20:22:10 +0000

From Brian’s post:
s/000d/0005/;

So in this case you have to use 0x000d – 0×0008 = 0×0005

By: sean nathan bean

sean nathan bean — Mon, 21 Jun 2010 20:32:10 +0000

thanks for this… but i have a queston and hope you are still around…

the only X-Mozilla-Status: taht i have run across that i don’t know how to retrieve is

X-Mozilla-Status: 000d

all the others i have figured out how to recover:

Find: X-Mozilla-Status: 001b Replace with: X-Mozilla-Status: 0013
Find: X-Mozilla-Status: 000b Replace with: X-Mozilla-Status: 0003
Find: X-Mozilla-Status: 1019 Replace with: X-Mozilla-Status: 1011
Find: X-Mozilla-Status: 101b Replace with: X-Mozilla-Status: 1013
Find: X-Mozilla-Status: 100b Replace with: X-Mozilla-Status: 1003
Find: X-Mozilla-Status: 000d Replace with: X-Mozilla-Status: ????

hope you are still paying attention to this blog

Sean

By: Craig

Craig — Sat, 19 Jun 2010 05:10:01 +0000

Thanks so very much for posting this. I was able to recover almost 1800 emails.

By: Undelete Files

Undelete Files — Sun, 20 Sep 2009 18:36:34 +0000

Great post, i stumbled onto your site and really enjoy the posts. Keep em coming.
~ greg

By: Dave

Dave — Tue, 11 Aug 2009 20:45:30 +0000

Thanks so much for this article! I was trying to hit shift-End to select a group of e-mails, and accidentally bumped the delete key after I did it. Not good. Was able to recover them all after this, so just wanted to say thanks for the info and insight!

By: walter

walter — Fri, 24 Oct 2008 08:34:00 +0000

thanks, it was very useful for me!

By: Brian

Brian — Tue, 27 May 2008 14:01:00 +0000

Thanks for the post! To add to what "anonymous" posted, I used the following to get the following unique statuses:
grep -E '^X-Mozilla-Status:' Inbox | sort -u | cut -d' ' -f2 > statuses

I then used the following ruby to mask 0x0008:
while line = gets
  oval = line.to_i(16)
  nval = oval & 0b1111111110111
  puts "#{line.strip} (#{oval.to_s(2).rjust(13, '0')}) => #{nval.to_s(16).rjust(4, '0')} (#{nval.to_s(2).rjust(13, '0')})"
end

Save it in translate.rb or something. That'll show you the conversion in both binary & hex. (ruby translate.rb statuses)

Finally, I took that and built a sed script similar to the following:
sed -e '/^X-Mozilla-Status:/ { s/0008/0000/; s/0009/0001/; s/000a/0002/; s/000b/0003/; s/000d/0005/; s/000f/0007/; s/0018/0010/; s/0019/0011/; s/001a/0012/; s/001b/0013/; s/001f/0017/; s/1009/1001/; s/100b/1003/; s/1019/1011/; s/101b/1013/ }' Inbox > Inbox.fixed

By: Stonewall

Stonewall — Mon, 10 Dec 2007 10:51:00 +0000

Excellent post! I too deleted my entire inbox with a shift-delete. OOPS! Your procedure worked to recover what looks to be a LOT of my deleted mails. Including about 14,000 spam messages! I did this on a windows box using the GnuWin32 version of sed.

The only difference was that I had to use double quotes in the command.

C:\Program Files\GnuWin32\bin>sed "s/X-Mozilla-Status: 0008/X-Mozilla-Status: 00
01/g" Inbox > FixedInbox

Thanks for the info, it saved my emails!

By: Anonymous

Anonymous — Mon, 15 Jan 2007 16:23:00 +0000

Thanks! You helped save my bacon – the only thing I may add is that the X-Mozilla-Status can be things like 0018 – meaning, that the message has been replied to and deleted, so a global replace of may miss some emails that have had other things done to them like replied or forwarded and then deleted.