Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several e-mail accounts configured in Thunderbird. I just wanted to move an e-mail from one of my e-mail accounts [A] Trash folder to another accounts [B] Inbox folder. Because the moved e-mail has been lost, Thunderbird doesn't shows it, but here's the catch: Another email appeared in the Inbox of the [B].

I found all my outgoing emails in /home/USER/.thunderbird/vzbrrs3a.default/ImapMail/[Gmail].sbd/Sent Mail, even the ones I deleted both from the sent mail folder and the trash folder.

Why does Thunderbird keep deleted e-mails?

share|improve this question
this isn't really a platform for rants against any vendor or product. If you have a specific security issue you're trying to solve, please ask that - but don't use it as an excuse to vent your frustrations. Feel free to use the Information Security Chat room for that... – AviD Jun 19 '11 at 12:16
And btw, I don't see how deleting emails is necessarily a security feature... especially if you consider backups, online storage, etc. – AviD Jun 19 '11 at 12:17
omg:D isn't that a bug, that it holds the deleted e-mails? YES, IT'S A SECURITY BUG. – LanceBaynes Jun 19 '11 at 12:35
deleted mails are just removed from the mailbox' index, but not removed from disk until you compact the folder (right click -> compact / file -> compact folders). i also think it's not nice to not inform the users, i want my deleted mails to be deleted... at least they are wasting disk space... (sry for this long comment, but unfortunately the question is closed.) – binfalse Jun 19 '11 at 14:11
up vote 9 down vote accepted

Logically deleting is very common in many application that handle huge amounts of data for performance reasons. This includes other email programs for example Microsoft Outlook and even database servers for example MySQL.

Even files, that you delete from your hard disk, are not actually destroyed. The space is just flagged as empty and may be override in the future.

In Thunderbird, compacting folders will get rid of those deleted emails. At least for me, Thunderbird regularly asks me whether I would like to do that.

I consider this problem a minor issue because an average user may not be aware of it.

An attacker needs read access to the storage folder in order to exploit this behaviour which is one of the worst case scenarios to start with. If you are concerned about theft of your notebook or other forms of illegal physical access, encrypting your hard disk may be better approach.

share|improve this answer
I'm not sure this even counts as a minor issue... but I accept the point of low-level users not being aware of this simple mechanism. Btw, most email servers do this too - so completely cleaning your client is still moot. – AviD Jun 19 '11 at 19:01
I never knew the "compact folders" solution before... but I still don't get it why do Thunderbird keeps the deleted emails :O :\ – LanceBaynes Jun 19 '11 at 19:07
This is similar for other mail applications too, not just Thunderbird, and it is designed functionality, not a bug or a security issue. You can configure other behaviours if you want. – Rory Alsop Jun 19 '11 at 20:43
@Rory, That's why mentioned Microsoft Outlook. But still, this behaviour is not what average users expect, so it is a (minor) issue, regardless of whether this happens in an email client, database server, office document or file system. – Hendrik Brummermann Jun 19 '11 at 20:55
@Hendrik and users didnt expect to click "Start" when they wanted to shutdown... unexpected behavior, while bad, is not necessarily a security issue. How does this relate to e.g. CIA? AAA? any other security aspect? – AviD Jun 20 '11 at 6:48

There are options related to email deletion in Thunderbird.

It can happen that it is set in your client to only mark the message as deleted, but do not really delete it or not immediately. These are part of the standard IMAP protocoll what you use to connect to gmail.

You should double check how yours are set up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.