Could there be a way to extract to extract the mail bodies from the __db.XXX files (for example by forcing the system into an inconsistent state so that cyrus uses its binary checkpoint and archiving files to recover) - or are the mail bodies _really_ just stored in the individual files (which have been definitely deleted) as Jules Agee pointed out?
What do you think - imagine you are allowed to do anything and not restricted to good manners or "clean" procedures. What else could I try?
No, no way to recover the mail bodies from the __db log files. They really are only for the Berkeley DB-based databases used by your cyrus install for 'accounting' purposes. Once the individual files containing the mail bodies are gone, they're gone.
Your only real hope at this point is if you have backups available, as I think Jules pointed out.
As a last ditch effort, if your mail spool isn't a busy file system (like that's a real possibility), then you could potentially recover the files by one of two methods I can think of. The first is by doing a raw edit of the disk, which is something I shudder to even think of trying to do. The second is to shut down the email server, unmount the disks/partitions, copy the disk(s) to a new (set of) disks, mount the new disk(s) and send the old ones to a professional forensic recovery company, which costs. Lots. At this point, though, it's quite likely that at least some of the sectors of the deleted emails have been overwritten with new emails.
-- ---------------------------------------------------------------------------- William K. Hardeman [EMAIL PROTECTED] http://www.wkh.org
--- Cyrus Home Page: http://asg.web.cmu.edu/cyrus Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
