Gmail big chunk of messages missing

[Rigo]

Customer brought in a case I've never come across.
All of a sudden a big chunk of her messages just disappeared, from 28 June 2023 to 27 July 2017.
Older messages and newer ones are present except anything that was in period gap.
I've checked all the folders just in case, nowhere to be found.
She's totally confident she didn't delete them, not in trash either.
Even the content of subfolders she had created to categorise her messages are missing.
I noticed some Gmail messages about successful account recovery on the 29 June 2023. They reckon they had changed their account pwd because they couldn't remember it on that day though they had had access to the emails. They are adamant it was not because they couldn't log into the email but she cannot remember why they did it. Reasonably senior people
Didn't think anyone would need to take regular backups of their Gmail messages

 

[seashore]

They reckon they had changed their account pwd because they couldn't remember it on that day though they had had access to the emails. They are adamant it was not because they couldn't log into the email but she cannot remember why they did it. Reasonably senior people

Phished?

 

[Rigo]

folders, only labels

I thought folders was what everyone else called them except Google?

 

[Rigo]

Phished

I did try to make sense of why change the password thinking someone slammed the access shut and they had to recover the account.
They said no, they could still access their mail prior.
They had the impression that the Google account was something different with a different password they couldn't remember, so they changed it to get access.
Since they could still access their email I concluded it probably was not due to a hack?

 

[Rigo]

when you look in All Mail

The missing chunk of messages is missing from there too.
The sub-labels names are still there but empty as well.
Any idea about how this could happen save from some hacking? I'll need to try to give them some explanation

 

[seashore]

All of a sudden a big chunk of her messages just disappeared, from 28 June 2023 to 27 July 2017.

I noticed some Gmail messages about successful account recovery on the 29 June 2023.

Just throwing it out there - is there a chance they recovered an old account instead of their current one? An account that hadn't been used since 2017?

 

[Rigo]

old account instead of their current one

Very interesting idea
New messages are coming in into this account since 28 June 2023.
If an old account and no one was sending anything through it, how would it be receiving messages if not the current one?
I'll attempt to clarify this tomorrow as it may be a valid supposition.

 

[Markverhyden]

First thing I would do is login to check account activity which includes login dates and times with IP addresses. I recently had a situation where a customer said all of a sudden she couldn't get into her email, thought her gmail was hacked. I discovered an account recovery notice and then a password reset notice. Not the most observant customer so I wasn't able to get specific answers. But it looked like someone had used a networkable TV in her home to connect to her Google account. So I'm guessing that was how that happened.

Last account activity - Gmail Help

You can see your sign-in history, including the dates and times that your Gmail account was used. You can also see the IP addresses which were used to access your account. See your account activity

support.google.com

 

[britechguy]

@Computer Bloke

I have found that 90% of what most end users will call about, convinced they've "been hacked," is the result of something they've done.

This specific example just screams that as being the most likely cause. What possible benefit would this particular deletion be to anyone, let alone an attacker?

 

[Rigo]

First thing I would do is login to check account activity which includes login dates and times with IP addresses. I recently had a situation where a customer said all of a sudden she couldn't get into her email, thought her gmail was hacked. I discovered an account recovery notice and then a password reset notice. Not the most observant customer so I wasn't able to get specific answers. But it looked like someone had used a networkable TV in her home to connect to her Google account. So I'm guessing that was how that happened.

Last account activity - Gmail Help

You can see your sign-in history, including the dates and times that your Gmail account was used. You can also see the IP addresses which were used to access your account. See your account activity

support.google.com

The 3 days historical log means I can't see anything about the period in question ~28 June 2023.
Thank you for the resource though.

 

[Rigo]

there could be a machine set up to retrieve and delete messages

They've only got 2 computers and 2 iPhones and haven't apparently changed anything except for the password.
She couldn't even understand what I was asking about 'browsers' when checking how she accessed her emails.

 

[britechguy]

She couldn't even understand what I was asking about 'browsers' when checking how she accessed her emails.

I've given up on asking about whether webmail is in use by asking whether they get their email in a web browser. I ask if they're using an email client such as Outlook or Thunderbird, and if the answer is no, ask if they enter "gmail.google.com" or "mail.google.com" in the address bar to get to their Gmail. People seem to recognize the URLs they enter (or see all the time) but have no idea it's a web browser they're seeing them in.

This is something I really just don't understand in 2023, but it's a fact. The idea that there are massive numbers of users who have no idea what "a web browser" is just floors me, since virtually all of them use one on anything from a daily to a very frequently otherwise basis.

 

[seashore]

Yes, I just ask "what do you click on to get to your email?"

 

[Mick]

Genuine Conversation.

Client: My email has stopped happening.

Me: OK - let's see if we can narrow things down a bit. Can you get on the internet?

Client: They're not on the internet - they're on this computer in my bedroom.

 

[HCHTech]

No, they're conceptually different. In Gmail's world you can apply more than one label to a message, which kind-of makes it look as if it's in more than one folder. You can also apply no label to a message, which makes it appear to be nowhere at all - except in All Mail.

Just veering off topic a bit, but I have always assumed that Outlook worked the same way - one PST file with everything and just a database field specifying which folder to display the message in - the difference being that gmail is more clever in that you can have multiple labels for an email, but with Outlook you can only have one. Thunderbird, on the other hand, uses a different mbox file for each folder, right? So that's clearly a different storage method than either Outlook or Gmail.

I've never seen the actual structure of any of them, though: a PST, an MBOX or an Exchange EDB file either so this is all just conjecture...

On the actual OPs issue, given that you have to use a correctly-formatted search to be able to delete a date-based range of emails like that, I would think it unlikely that the user did it accidentally. I would be more inclined to believe a database corruption of some kind was at the root of the issue.

 

[Markverhyden]

Genuine Conversation.

Client: My email has stopped happening.

Me: OK - let's see if we can narrow things down a bit. Can you get on the internet?

Client: They're not on the internet - they're on this computer in my bedroom.

Reminds me of the one that's been floating around for years about trying to troubleshoot a computer that's not working.

Technician - can you see if the power cords are plugged in under the desk?

Customer - I can't see anything. The lights are out.

 

[callthatgirl]

Are you talking about Outlook missing emails or emails missing on the Gmail browser?

 

[callthatgirl]

Ok, read this again and now I'm assuming Outlook is missing gmail email.

So many things, first I'd ask her if she tried to fix this herself, or a family member or yet another tech before you. If so, then stop what you're doing and go into backup mode. I see this all the time in my field, people have mucked with the Outlook bad before calling me and the data is there usually somewhere else, wherever the other person lost it. IMAP for Outlook can break and email will be in Outlook that's not on the server and vice versa. POP emails can be in another computer or another profile with a PST.

Too many variables here. If you're stuck this week, I'm happy to help you at no charge to see what I can find.

 

[Rigo]

now I'm assuming Outlook is missing gmail email

Incorrect, they are accessing their email through Chrome.
If it were through Outlook there would be some hope of repairing or extracting from local cache.
Don't know what repairs would be available on webmail access

 

[Rigo]

Even on their phones

That I'm not quite sure as I was focusing more on the problem on the computer.
And I think you're right about the mail app on the phone.
I cannot rule out POP3 configuration on the phones but still odd how a chunk would be missing for specific period as in this case. POP would delete messages older x days than not from xx to yy only?