I majorly fucked up at work today when I realized I had deleted thousands of emails from a former co-worker’s computer… and The Company needed them. This is a story of quasi-redemption through use of one good tool and a little ingenuity.
I was cleaning up a former co-worker’s PowerBook, archiving documents, etc. in preparation to remove her user account from OS X and ready the machine for the next new hire. At one point, I asked, “Self, is there anything in her user account that you forgot to backup?” I answered, “Nope, I’m pretty damned sure I got everything,” and zapped her account using the “Delete Immediately” button in the user management dialog.
There was one thing that The Foof (our Ops Mgr.) explicitly asked me to do, and that was yank and save the former co-worker’s email off the machine. It was of the utmost importance. This was made clear to me multiple times in the past—shit even in the recent past—but not yesterday. I didn’t snag her email archives from the account before I deleted it with the click of one blue, candy-like button.
I fucked up royally, and fucked The Company who collectively has to support her ongoing programs after her departure.
I scoured the web a bit and came upon FileSalvage by SubRosaSoft.com. It told me there was nothing at all recoverable on the disk. That wasn’t hard to believe, as I’d run a couple of software updates after killing the account, and the spots where her account data was stored on the drive could very well have been overwritten. On a second try, I found Data Rescue II by Prosoft. I downloaded the demo—which provides a full list of recoverable data for free—and let it run.
Lo and fuckin’ behold, it said there were Apple Mail files (along with tons of others) that could be recovered! So I shelled out $249 in Company Credit and bought the IT license (see note 1 below). I entered the product code, and let it run wild through its glorious recovery process.
After an hour or so, I ended up with 557 .mbox files (see note 2 below) to work with. So what the hell are you supposed to do with 1.2GB of .mbox files? Get them back into the Mail.app using its Import wizard thingy, which is quite useful and slow as fuck thankyouverymuch. Not only is it slow, but Mail.app also takes a massive shit (crashes) when trying to import invalid .mbox files that have been incorrectly identified as such (see note 3 below) by the data rescue utility.
Despite its shortcomings, this approach teased out 545 usable .mbox files, and resulted in 9664 emails. Of course, any semblance of prior organization is completely lost, but we have the correspondence and it’s back inside Mail.app. It is now also fully searchable thanks to Spotlight. Sure, any binary attachments to the recovered emails appear as plain-text gibberish at the ass end, but the recovery app also undeleted 1,785 “office” docs of various flavors, 1,628 rich-text files, and 928 PDFs… many of which correspond to the aforementioned attachments.
It’s not an elegant solution, but I warned you this was a story of quasi-redemption.
Note 1: I opted for the IT license of Data Rescue II because: A) it would have been wrong to buy the $99 personal license even if I only use it once, B) given the OS X nature of our office and my other co-workers, there’s no way in hell that I’ll only end up using it once, and C) BinaryBiz’ VirtualLab product charges $100 per gigabyte of restored data (reasonable); yet, this one restoration alone—mail and doc files—would have cost more than Data Rescue’s IT license with no future cost and free reign over my miniscule IT domain.
Note 2: .mbox files are text files that contain one or more email messages, and are basically the “industry standard” method of storing email on a computer. Each email entry inside the .mbox file comprises a “postmark”, followed by the e-mail message formatted according to RFC 822/2822.
Note 3: The 12 invalid files that the recovery app marked as .mbox files were non-email-related, text-based files that just so happened to begin with “From ” (that’s F-r-o-m-space), which is how .mbox files delineate individual messages in the “postmark”.