On 3/8/2022 5:51 PM, doug wrote:> Hi All,
>
> I'm trying to trace an attachment within an SIS subdirectory to the
> email message(s) that link to it. I say messages because I'm also
> using dovecot dedup. My understanding is the linked file name is the
> hash value of the attachments contents concatenated with the GUID of
> the email message. I have had marginal success with a message I
> created myself.
>
> Example: I generated an email with two attachments. Here are the links
> in my attachment directory.
>
./26/c5/26c5c540d41779d83d2f5388041d05c67d720d9a-73eca8051acd276272310000f2bc99a3
>
>
./65/cd/65cd73112a489ef07f17ed5740aa60358e2dd3fb-74eca8051acd276272310000f2bc99a3
>
>
> In my sent folder the actual GUID of the message is
> 75eca8051acd276272310000f2bc99a3.? So the GUID of the attachment is
> based on the GUID of the message, but not exact. The second hex byte
> seems to be decremented as an offset of the attachment index from the
> GUID of the message. At least in my one example.
>
> # doveadm dump
> /mailstore/doug/mail/mailboxes/Sent/dbox-Mails/dovecot.index | grep
> guid | tail -1
> ??? - guid: 75eca8051acd276272310000f2bc99a3
>
> With that actual GUID I can find the message with a search:
> # doveadm search -u doug mailbox Sent guid
> 75eca8051acd276272310000f2bc99a3
> doug e5711f1cf2c9294f71090000059b96e4 53526
>
> Now let's try to track down another email when only the HASH-GUID
> value is known. Here is one randomly picked.
>
>
./00/a2/00a2d5de3e41053d59bd10084826bbe094aa1c59-57857b09d1a327627e260000f2bc99a3
>
>
> # doveadm search -A mailbox '*' guid
57857b09d1a327627e260000f2bc99a3
> # doveadm search -A mailbox '*' guid
58857b09d1a327627e260000f2bc99a3
> # doveadm search -A mailbox '*' guid
59857b09d1a327627e260000f2bc99a3
>
> I repeated this incrementing and decrementing from 5085... through
> 5f85... and never located the message.
>
> This seems like it should be trivial but I've been struggling with it
> for days. The GUID isn't random, there must be a way to track the
> attachment back. What am I missing?
>
> And for those wondering why, our virus scanner flagged a number of
> attachments, some with several links, and I want ask the users to
> delete the offending messages so I can purge them from the server. If
> I can find the emails I can give them the mail folder, date/time, and
> subject of the message.
>
I keep experimenting with this and I still haven't found a reliable way
to track an attachment back to it's original message so I can either
notify the user or delete the message with doveadm. Is this not
possible? I'm using mdbox if that matters. I see a similar thread going
right now about virus scanning and deleting messages but that is maildir
and I suspect not using SIS for attachments.
--
Doug