Overview

While tracking and diagnosing lost user emails, the Kerio Connect can log user interactions in the corresponding logs. The user might have deleted the emails from Outlook or it could have been deleted using mass deletion, so-called Items Clean-out feature. The user reindexing was already tried and did not restore the older emails.

Preconditions

Access to the Kerio Connect Administration

Diagnosis

All email actions, such as moving, deletion are stored in the Operations log.

It specifically tracks the movement/deletion of items in users' mailboxes. For more information about logs, please refer to Types of Logs in Kerio Connect.

Log files can be exported to a .txt file by right-clicking on the log and selecting Save Log and then choosing Plain text and either Full File or Selected Rows.

Note: the full file can get very large if your server has been in use for a long time.

Items Clean-out and any form of mass deletion would appear under the Operations log (Items clean-out originating from $cleanout_agent user).
Below you can see the log entries for test Spam messages being deleted out of Sent Items in Outlook (using KOFF).

Solution

Once the missing emails are identified, they can be restored using the KMSrecover tool (examples for Linux, Windows, macOS) or manual backup restoration process.