I was clearing a bunch of dead accounts from my email server, using the ClearOS webadmin console. I erroneously deleted an account that was still active. I was able to use extundelete to save the situation. This same procedure will work for all files, not just email.
ClearOS forum member Yaye created an extundelete rpm, but it's for ClearOS 6 - 64bit. It's available here: https://www.mediafire.com/?dpas2kkbetdkd02
If you want to run extundelete from a Live CD, it is on the Parted Magic CD -
http://partedmagic.com/doku.php?id=start.
It's listed in the Console Utilities section.
To duplicate the following procedure you will need to be able to push a few files onto your server (via sftp, or USB drive)
Go to http://extundelete.sourceforge.net/ and download extundelete-0.2.0.tar.bz2 - transfer this to root's home folder on your server (or you can wget http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.0/extundelete-0.2.0.tar.bz2)
The other needed files were available through the default repos
Commands:
[root@myserver s]# yum install -y gcc-c++ autoconf automake [root@myserver s]# yum install e2fsprogs-devel.i386 [root@myserver s]# wget http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.0/extundelete-0.2.0.tar.bz2 [root@myserver s]# tar -xjf extundelete-0.2.0.tar.bz2 [root@myserver s]# cd extundelete-0.2.0.tar.bz2 [root@myserver s]# ./configure [root@myserver s]# make [root@myserver s]# make install
Now if you have made the appropriate sacrifices and penance, no errors should have popped up. In order to perform the actual recovery, you will have to unmount the various filesystems. For reasons I do not comprehend, there is a boat-load of mount points in our Clearbox 300 server. You likely only need to umount the imap directory, but I wasn't taking any chances at this point. I tried to umount just /store/data/live/server1 but that did not work.
Commands:
[root@myserver s]# umount /store/data0/live/server1/home [root@myserver s]# umount /store/data0/live/server1/mysql [root@myserver s]# umount /store/data0/live/server1/mysql [root@myserver s]# umount /store/data0/live/server1/root-support [root@myserver s]# umount /store/data0/live/server1/samba-drivers [root@myserver s]# umount /store/data0/live/server1/samba-netlogon [root@myserver s]# umount /store/data0/live/server1/samba-profiles [root@myserver s]# umount /store/data0/live/server1/shares [root@myserver s]# umount /store/data0/live/server1/shares [root@myserver s]# umount /store/data0/live/server1/www-cgi-bin [root@myserver s]# umount /store/data0/live/server1/www-default [root@myserver s]# umount /store/data0/live/server1/www-virtual [root@myserver s]# umount /store/data0/live/server1/imap
Now extundelete has a bunch of options for limiting the scope of file retrieval, but I went for the whole shebang.
[root@myserver s]# extundelete /dev/data/data0 --restore-all
That gronked along for a while, showing all the files being recovered to: /root/RECOVERED_FILES/ and a lot of unloved inode info was dumped there. In my case, the good stuff was in: /root/RECOVERED_FILES/live/server1/imap…/a /b /c d/ etc
I cleaned up and rebooted the server, and was able to recreate the user account, transfer all the data into their folder, change permissions:
[root@myserver s]# chown cyrus:mail -R USERNAME/
and then perform a cyrus reconstruct:
[root@myserver s]# su - cyrus -c "/usr/lib/cyrus-imapd/reconstruct -rf user/USERNAME"
Login user account to check, and reset message flags1)
I hope this helps someone else here. The undelete could be used on any of the directories that use ext filesystems.
Regards Ken
In all the times I have used cyrus reconstruct, it always ignored the 'read' or 'seen' flag, and all messages appear to the user as unread.