Perhaps the most important question is, do you have Thunderbird deleting the server copies when it downloads a copy to your PC?

No, I keep incoming mail on the server, but there are a lot of emails that I keep on my computer but delete from the server manually -- emails that are less important or that contain sensitive information. I can download what's still on the server onto my wife's computer by setting up a Thunderbird POP3 account there and then copying that profile to my own computer. But I will still have lost a lot of important emails, and of course I've lost all of my sent messages, which I really need. So I want to try to retrieve what vanished from Thunderbird before I give up and start all over again with what's on the server.

I honestly don't see how the mbox files (the Sent and Inbox files without an extension) got deleted and replaced by smaller ones which, of course, do not contain your old messages. The only things that come to mind are over-protective behaviour from antivirus or security programs running on your PC, malware (e.g ransomware) activity or rogue PC cleaning/optimization utilities.

You could use data recovery software to try and recovery the backup mbox files before you overwrote them with the new shrunk ones. They just may still be physically present and intact on the drive.

Thanks for the advice.

I've been running the same anti-virus software (Webroot with AVG Free as a backup) for years and have never had a problem like this -- in fact, I've never had any problem at all with them. A deep scan found no malicious software. I wouldn't know how to diagnose a problem with PC cleaning or optimization. The emails all disappeared without warning at some point yesterday evening.

I did a web search last night and this seems to be a not uncommon problem in Thunderbird, but most people fixed it by repairing the files or deleting the .msf files. It's my bad luck that these didn't work.

I downloaded recovery software but it could not find the files on the portable HD.

What I don't understand is that, if I do any kind of search in either Inbox or Sent, I get a complete list of all emails containing the search terms, all the way back to the year 2000 or earlier. The search doesn't just find the emails -- much of the text is there, too. But if I click on the email it shows blank.

How is it that the emails have vanished but Thunderbird's search can reproduce them? They must be somewhere on my computer? If so, how can I find them?

RE: How is it that the emails have vanished but Thunderbird's search can reproduce them?

Search is using the global database file which still has a log of all the headers of emails, but when you select email it cannot display because it does not exist. I suggest you rebuild the global database to get it up to date.

• https://support.mozilla.org/en-US/kb/rebuilding-global-database

re :At first all of the inline information was still listed (subject, recipient, date, etc.) and the "Total" notice on the bottom right said I had 13,000 emails, but when I opened messages they were completely empty.

This means something only and specifically deleted the mbox files. The index files were still intact and so showed header info of emails, this made it look like you had emails.

RE:When I did a repair on the Inbox and Sent, the messages simply disappeared altogether.

This means the index files were created a fresh to show what was really in the mbox files that contain emails. It did not delete the emails, they had aready gone.

If Thunderbird had compacted those files and those files were corrupted, a loss of email can occur, but the index file should have also been auto updated unless the process was interrupted, eg: you exited Thunderbird. If you cannot see any nstmp files in the pop mail account profile folder, we can rule out compacting of corrupted files.

Check the profile pop mail account name folder for any nstmp files as they may contain emails which could be recovered.

• http://kb.mozillazine.org/Nstmp_folders

Anti-Virus products are notorious for loss of emails. They scan either incoming mail or scan mbox file. They have no concept that one single text file actually holds more than one email. They find one email they do not like and the whole file gets 'fixed' or maybe 'quarrantined'. However, Anti-Virus does not know about the index files because they do not contain emails, so they leave them alone. So the fact that you had intact index files, but completely deleted mbox files is suggesting the 'Anti-Virus' or other malware products were a possible culprit. If you want scanning to occur on emails then it is vital that Anti-Virus products are set up to ask what to do and not auto fix. This allows you to tell it not to fix or quarrantine anything to do with Thunderbird files. Alternatively, make Thunderbird files and folders exempt from scanning.

It is worth checking to see if the mbox files (no extension) have only been quarrantined and can be retrieved.

It is also advisable to not overwrite your one and only backup. Always keep backups in a folder that has a date named folder and keep at least two lots of backups. Old backups can be deleted when it is obvious they are no longer required.

If you open the current 'Inbox' mbox file using a text editor program like Notepad and it really is empty and you cannot locate anything that may have been quarrantined and there are no nstmp files as previously mentioned then:

• Exit Thunderbird,
• access the profile folder,
• click on 'Mail' folder,
• click on pop mail account name folder
• delete the 'popstate.dat' file.

The 'popstate.dat' file keeps a record of what has been downloaded, so if you delete it and then start Thunderbird, it will look at Inbox on server and completely download everything on server, so you do not need to create another account on wife's computer.

You mention 13,000 emails dating back to 2006. You were storing all those emails in one single text file document.

I would advise you create folders to organise and store emails. Emails older than the current year could be Archived, so that this maintains recent emails in those folders. It also spreads emails through various files, so they remain much smaller and less prone to corruption.

• https://support.mozilla.org/en-US/kb/archived-messages

Compacting is vital to maintain healthy files as it removes all hidden marked as deleted emails and keeps file size as low as possible.

• https://support.mozilla.org/en-US/kb/compacting-folders

Hi. Thanks for the thorough review and advice. There are no compacted files in the profile and nothing in quarantine under either Webroot or AVG. A scan this morning found no malware, but I'll run malware bytes after I've exited here to double-check. I found an old backup of both Inbox and Sent files from the end of January this year which I can use to restore most of the lost emails, and then download all incoming email since January from the server. It won't have everything I need, but it will have most things. Of course any mail I've sent since the end of January is gone forever.

It's useful to keep the old general database without updating it. It gives me a searchable record of everything I lost and I can at least find dates, subjects, and sender/recipients, plus some of the text. I frequently need to do these kinds of searches, so I don't want to lose these data.

I'll implement all the measures you suggest about backups, file organization, and compacting.

Again, thanks for the detailed analysis.

Lets back up just a little.

Almost all cases where files just disappear fall into two categories.

1. The anti virus has detected what it thinks is a virus and deleted the file, or places it into a quarantine. I suspect that is the case here as two files were affected at the same time.
2. Hard disk failing. After many year of stability, many of the earlier SSD drive are starting to fail, but all drives are subject o failure, that is why Microsoft have bundled a disk checking utility with their operating systems since Dox 1 arrived on an IBM PC. While I consider this less likely an integrity check and surface scan can never hurt. The chksdk command is the Microsoft tool but you can also initiate a drive check from the defrag tools and that is the easiest way. A defrag should not however be run if there is a possibility of low level recovery being used on the file system for this issue.

While I am not a fan of any of the tools from ccleaner, their recuva has quite a following and an easy to use file recovery wizard that makes low level recovery an option of the inexperienced.

In the first instance I would check the Anti virus logs for evidence it found something and what it did with it. That way you will not be guessing.

Also, please clarify exactly how you use Webroot as your main antivirus and AVG as a backup? You're not supposed to have more than one antivirus program running on your pc because they will not only impact performance, but will also conflict with one another and wreck havoc on your system.