A deleted message is usually recoverable for a period, and the chance drops with every hour. Work through these in order, and stop using that mailbox from any device while you do.

1. The trash, on the server

Look in webmail, not only in the phone or the desktop client. Some clients hide the trash folder or use a local one, so mail that is still on the server appears gone.

2. Another device that has not synced

If a laptop still shows the messages, disconnect it from the network before opening the mail app. The moment it syncs it will apply the deletion and the last copy is gone.

Then copy the messages to a local folder, or drag them into a file, before reconnecting.

3. On the server itself

ls -la /var/vmail/example.com/sara/.Trash/cur/ | head
grep -rl "the subject line" /var/vmail/example.com/sara/ 2>/dev/null | head

Maildir is one file per message, so a message that is still on disk can simply be copied back into cur/ and it reappears. Fix the ownership afterwards or the mail server will not show it.

4. The backup

restic -r /srv/backup snapshots
restic -r /srv/backup restore <id> --target /tmp/restore \
       --include /var/vmail/example.com/sara

Restore to a temporary directory, never over the live mailbox. Then copy in the specific messages you need - see backing up mail.

5. The sender

Unglamorous and it works: ask them to send it again. For one important message it is faster than everything above.

Afterwards

  • Set the trash to keep messages for 30 days rather than emptying on exit.
  • Make sure mail is in the backup at all - it usually is not.
  • Use IMAP, so no single device holds the only copy.