[SOLVED] emails mysteriously deleted

[padraig]

One of our users reported:

All my emails were moved to my trash on 26/1/09 and a lot of them have been mysteriously  deleted.

Can you reverse this?

Is it possible to track if the e-mails were accidentally deleted or is there a log file
which would have this

[uxbod]

Have a look in /opt/zimbra/log/audit.log to see if anybody else has accessed that mailbox. It would be worth to change the password on that account aswell.

[padraig]

Didn't notice any thing unusaul in the audit.log.

If I restored the users ac with the redologs he is still missing e-mails.

However if I restored the users ac without the redologs and the missing e-mails appear.

Is it possible there is a delete command in the redo logs & if so how do i see it