TABLE OF CONTENTS


Overview

Recover deleted emails for a cPanel email account from a VPS backup image. Applies to CentOS 6 through AlmaLinux/Rocky 9 WHM/cPanel VPS on Mammoth Cloud or BinaryLane. Backup images are raw, byte‑for‑byte. Typical devices: live disk /dev/vda, attached backup /dev/vdb (often with a single partition /dev/vdb1).


What You'll Need

  • Root SSH access (or use the mPanel rescue console if SSH is unavailable)
  • <CPANEL_USER>: the cPanel account name (e.g. acme)
  • <DOMAIN>: the domain for the mailbox (e.g. example.com)
  • <MAILBOX>: the mailbox local‑part (e.g. john)
  • Mailbox path: /home/<CPANEL_USER>/mail/<DOMAIN>/<MAILBOX>/


Important Notes

Warning: For large restores (tens of thousands of messages), allow time for Dovecot to reindex after files are copied. To avoid mail delivery/index contention during the real copy, stop Exim and Dovecot just before copying, then start them again afterwards.


Prepare and Attach Backup

  1. In mPanel, create a fresh temporary backup to ensure the server can be restored from its current state if needed (do not overwrite existing backups): https://home.binarylane.com.au/server/-/backups/create
  2. Select the backup you need to recover files from (not the temporary backup created in step 1), and click Attach. Wait for the attach to complete.
  3. Login to the server as root using SSH.


Identify Disks

Locate the attached backup device (typically /dev/vdb):

ls -la /dev/v*

You should see a device named /dev/vdb. This is the backup image to mount.


Mount Backup

Mount the attached backup read‑only:

mount -o ro /dev/vdb /mnt


Define Variables

Replace placeholders with actual values for the mailbox you need to recover, such as CPANEL_USER="mysmallbiz", DOMAIN="mysmallbiz.com", and MAILBOX="john":

CPANEL_USER="<CPANEL_USER>"
DOMAIN="<DOMAIN>"
MAILBOX="<MAILBOX>"

SRC="/mnt/home/$CPANEL_USER/mail/$DOMAIN/$MAILBOX/"
DST="/home/$CPANEL_USER/mail/$DOMAIN/$MAILBOX/"
DATE="$(date +%F)"


Dry‑run

Perform a no‑impact preview and review the log and counts:

logfile="/root/rsync_${CPANEL_USER}_${DOMAIN}_${MAILBOX}_dryrun_${DATE}.log"
rsync -aiv --ignore-existing --dry-run "$SRC" "$DST" | tee "$logfile"
rsync -aiv --ignore-existing --dry-run "$SRC" "$DST" \
  | awk '/^>f/ {count++} END {print "\nTotal files to copy: " count}' \
  | tee -a "$logfile"

This checks the entire mailbox directory from the backup for files that need to be copied to the working disk without replacing existing files.


Stop Mail Services

Stop Exim and Dovecot to avoid delivery/index contention during the real copy:

/scripts/restartsrv_exim --stop
/scripts/restartsrv_dovecot --stop


Perform the Copy

Execute the real copy with logging and counts:

logfile="/root/rsync_${CPANEL_USER}_${DOMAIN}_${MAILBOX}_realrun_${DATE}.log"
rsync -aiv --ignore-existing "$SRC" "$DST" | tee "$logfile"
rsync -aiv --ignore-existing "$SRC" "$DST" \
  | awk '/^>f/ {count++} END {print "\nTotal files copied: " count}' \
  | tee -a "$logfile"


Fix Permissions and Start Services

Repair mailbox permissions, then restart mail services:

/scripts/mailperm "$CPANEL_USER"
/scripts/restartsrv_dovecot --start
/scripts/restartsrv_exim --start


Reindexing

Dovecot will rebuild indexes on demand when the mailbox is accessed. After large restores, this can take minutes to hours. Logging into Webmail once for the mailbox helps trigger it.

Optional: if available, you can force an index for a single mailbox (replace placeholders):

# doveadm index -u "${MAILBOX}@${DOMAIN}" INBOX


Verify and Clean Up

  • Confirm recovered messages are visible via IMAP/Webmail.
  • Optional: remove the two rsync log files created above:
rm -f "/root/rsync_${CPANEL_USER}_${DOMAIN}_${MAILBOX}_dryrun_${DATE}.log" \
      "/root/rsync_${CPANEL_USER}_${DOMAIN}_${MAILBOX}_realrun_${DATE}.log"
  • Unmount the backup before detaching it in mPanel:
umount /mnt


The VPS backup image you recovered files from is now detached. The temporary backup created earlier will expire automatically in 7 days.