Discovering who deleted shared email

[Cryophallion]

I have a very small install of Zimbra where I work. Today, I noticed that all the emails in my companies main inbox are all gone. This inbox is a shared folder that all the salespeople have access to, but no one will say they did it). I am not sure how best to discover who deleted the emails, and when (I have 3 days of backups using the backup script, but most people were gone for the holiday, and so I am pretty sure the emails are gone).

Sent and trash still exist, but I wanted to know if there was a way to find out who deleted what, and when.

Thanks,
Cryo

P.S. I was able to send a test message to the mailbox, and it appeared, so the mailbox appears to be working.

[uxbod]

Have a look in /opt/zimbra/log/audit.log to see who accessed the mailbox (I think it has those details).

[Cryophallion]

Only shows today's activity (due to the shutdown from the backups script I assume), and I'm the first one to access it.

Is there some record in the mysql database?

[uxbod]

Is there a audit.1.gz file where it has been rotated ?

[Cryophallion]

Of course it was rotated... I am officially an idiot.

Hmm, nothing really there, which means it must have happened this morning (since the account has no email in the inbox, except the one I sent it, and that account gets lots of email).

So it was one of 3 of us. Nothing somewhere that records deletions? oh well.

[Cryophallion]

Upon further thought, I have to assume a bit flipped or something, as it would have taken some work to delete all that email (multiple pages), although mysql reports it is fine, and an upgrade to 5.11 changed nothing (nor did a re-index). Any thoughts from anyone else?

[ArcaneMagus]

Did somebody access the mailbox via POP3? Or IMAP for that matter...but via IMAP they would have had to delete it themselves whereas with POP it would have deleted everything downloaded...

[Cryophallion]

Nope, both are disabled. Only access is via web client, and the people who were accessing it wouldn't have done it (nor have the time to delete all those pages of emails)