[SOLVED] Restore from backups seems to just duplicate the current mailbox

[ZZZ]

One of our Zimbra users accidentally deleted his emails between 2010-06-18 and 2010-06-22. The deletion took place on 2010-06-23.

I have backups as follows:

drwxr-x--- 6 zimbra zimbra 48 Jun 19 05:01 full-20100618.220013.785
drwxr-x--- 6 zimbra zimbra 48 Jun 21 01:01 incr-20100620.220016.331
drwxr-x--- 6 zimbra zimbra 48 Jun 22 01:01 incr-20100621.220014.294
drwxr-x--- 6 zimbra zimbra 48 Jun 23 01:00 incr-20100622.220015.804
drwxr-x--- 6 zimbra zimbra 48 Jun 24 01:00 incr-20100623.220014.207

However, if I use any of these to recover, the deleted emails are still missing AND the restored mailbox has newer emails than the timestamp. It is as if Zimbra just copies the current mailbox without restoring it from the backups. I use the restore tool (restore to another mailbox with restored_ prefix) from the administrator GUI.

[phoenix]

Originally Posted by ZZZ

One of our Zimbra users accidentally deleted his emails between 2010-06-18 and 2010-06-22. The deletion took place on 2010-06-23.

I don't really understand that statement, did the email get deleted between the 18th-22nd June or did they get deleted on the 23rd June? Do you mean that on the 23rd June he deleted all his email from 18th-22rd June? What happens if you use the Full Backup from the 19th June and the incremental from the 21st-23rd June, does the restored mailbox contain the email? Did you reindex the restored mailbox after it was created?

[ewilen]

ZZZ, what exactly is your restore procedure?

I find it is very easy to recover deleted mail using the admin GUI. There's no need to choose a particular backup to restore from. However, you must choose to restore to a point in time (choose a time prior to the deletion, but obviously after the time the deleted object was created), and you must choose to prepend a prefix to the specified account.

The result will be a duplicate account containing the necessary data. You should immediately edit the account to hide it in the GAL. (This prevents user confusion when doing autocomplete and other name-based lookups.) Then share the folder(s) containing the deleted items to the original account. The accoun owner can then mount the folders, copy the needed items, and dismount the folders. Finally, delete the duplicate account.

[ZZZ]

Thanks for the replies.

Yes, it was on 2010-06-23 when the user deleted his emails between 2010-06-18 and 2010-06-22. Since there is no full backup from 2010-06-19, I need to use the previous one from 2010-06-18 (full-20100618.220013.785).

How can the restored mailbox contain emails newer than specified in the "Restore to a point in time" selection in the admin GUI? The restore operation seems to use the most recent backup regardless the time point I specify. The most recent backup, in this case, is not what I'm after. I tried the recovery using several timepoints prior to the date the deletion took place (2010-06-23).

Reindexing the restored mailbox did not make a difference.

It would be great to have "view mail" (or at least "view subjects/timestamps") feature for backups also.

There seems to be similar issues:
zmrestore point-in-time recovery not working

[ZZZ]

I managed to restore 99 % of deleted mails using the following CLI command:
zmrestore -a user@domain.com -ca -pre restored_ -lb full-20100618.220013.785 -restoreToIncrLabel incr-20100622.220015.804

This command seems to work as expected, whereas the GUI equivalent seems to restore the most recent backup.

[ewilen]

Probably this bug: Bug 33135 – unable to restore to point in time/incremental

You should upgrade, not only for that, but also a bunch of bugfixes and security patches in 5.0.x.