Dumpster Recovery

Search mail that users deleted even from their trash per account, view it read-only, download it as .eml or recover it to a folder you choose; every content access is audited together with its reason.

Global administratorDomain administrator (on accounts they may access)Admin console › Tools › Dumpster Recovery

What it is for

When a user deletes a message from the trash as well, Zimbra does not drop it immediately: with the dumpster enabled it is kept for zimbraMailDumpsterLifetime. Dumpster Recovery lets you find and return those messages for a support request or a legal process. Which administrator accessed which message in which account, and why, is recorded.

The dumpster must be enabled

For anything to appear, zimbraDumpsterEnabled=TRUE must be set and the message must be younger than zimbraMailDumpsterLifetime. If it is off or the time has passed, a search returns nothing.

Searching

1. Open Tools › Dumpster Recovery › the Search tab.
2. Enter user@domain in Account. Changing the account clears the active reason.
3. Optionally fill From, Subject / text, From date and To date, then Search.
4. The result table shows sender, subject, Previous folder, deletion time, size and attachment flag. Results arrive in pages; use Load more for the rest. Refresh re-runs the last search from the start.

Reason and logging

The first content action (view, download, recover) opens the reason dialog.

• Reason is required: at least 10 and at most 500 characters. Example: "User called on 20.10 and asked for this message".
• Case / file no is optional and is used to filter the report.
• The reason and case number you enter are kept for the session while the screen stays open; use the Change reason link for a new one.

All actions, including searches, are written to the admin audit log (AdminAuditLog): acting administrator, account, messages, reason and time.

Viewing, downloading, recovering

• View: select one message and click View. The viewer is read-only; scripts and external images are blocked. Inline images are shown through short-lived (10 minutes at most) capability URLs.
• Download: Download .eml downloads the message, Download in the attachment table downloads a single attachment.
• Recover: select one or more messages and click Recover.... Pick the Target folder from the folder list (if the list cannot be loaded, Inbox is used). The result window shows the new id or the error for each message.

Download links are single-use and valid for 60 seconds. The DumpsterDownload audit line is written when the link is prepared, so an unused or expired link is still recorded.

History

The History tab lists the audit trail of Dumpster actions: time, administrator, action (Search, View, Download, Recover), account, reason and case number. Filter by Case no, start and end date; the default range is the last 7 days. Export CSV downloads the list (cells are protected against spreadsheet formula injection). If the list is truncated, narrow the filters.

History shows the audit log of the server that answers the search; each action is logged on the server that received the request. In multi-mailstore setups collect audit.log from every mailstore (or always use the same admin console server) for a complete legal trail.

Granting access (Delegated Admin)

1. Tools › Delegated Admin › New Admin.
2. Choose the account and domain, tick the Dumpster Recovery capability and click Apply.

This capability grants the stock adminLoginAs right on the domain (inherited by its accounts), the Dumpster Recovery screen and the zimlet list rights. A domain administrator can act only on the dumpster of accounts for which they hold adminLoginAs; an unauthorised or nonexistent account yields the same "permission denied" error.

The preset grants adminLoginAs on the domain, which also enables the stock "Log in as / View Mail" on live mailboxes. That stock path has no reason prompt and no Dumpster audit line (it appears as a DelegateAuth / mailbox access entry in User Audit).

Other administrators are visible in the history

On the Dumpster history of accounts they can access, a domain administrator also sees the acting identity, IP address and user agent of other administrators. This keeps access per account transparent. A domain administrator does not see the User Audit zimlet; only the Dumpster history.

Security notes

• Do not use the zimbra system account for interactive admin console sign-in: internal calls trust that account's token.
• Inline images are served only through short-lived (10 minutes at most) capability URLs; they are single-purpose and invalid once they expire.
• Logs contain personal data and message details; restrict history access and CSV export according to your organisation's data-protection policy.

Report and known limitations

Dumpster actions also appear as Dumpster* events in the Admin and session report of User Audit and can be searched with the ref (case number) filter.

Supported versions: Zimbra 9 (build 1038) and Zimbra 10.1.16.