Overview

While tracking and diagnosing lost user emails, the Kerio Connect can log user interactions in the corresponding logs. The user might have deleted the emails from Outlook or it could have been deleted using mass deletion, so-called Items Clean-out feature. The user reindexing was already tried and did not restore the older emails.

The procedure outlined in this article is also applicable for a shared mailbox/folder.

Preconditions

Access to the Kerio Connect Administration

Diagnosis

All email actions, such as moving, deletion are stored in the Operations log.

Actions such as discard/delete performed by filters will not be tracked on the Operations logs. Although the Operations logs will show you the delivery/forwarding of the emails, actions such as move to trash, for example will not be tracked there. For this use case you can actually track these when the "Sieve Filter" debug logs are enabled (see Selecting Debug Log Messages to Display).

It specifically tracks the movement/deletion of items in users' mailboxes. For more information about logs, please refer to Types of Logs in Kerio Connect.

Log files can be exported to a .txt file by right-clicking on the log and selecting Save Log and then choosing Plain text and either Full File or Selected Rows.

Note: the full file can get very large if your server has been in use for a long time.

Items Clean-out and any form of mass deletion would appear under the Operations log (Items clean-out originating from $cleanout_agent user).
Below you can see the log entries for test Spam messages being deleted out of Sent Items in Outlook (using KOFF).

Solution

Once the missing emails are identified, they can be restored using the KMSrecover tool (examples for Linux, Windows, macOS) or manual backup restoration process.