Check your system's maildrop area, EG /var/mail, /var/spool/mail
or /usr/spool/mail (or sometimes a database somewhere), to see if the
user's mail is there. If it is, then there's probably some sort
of POP, IMAP or MUA issue.
In an alternate maildrop-ish area?
If mail is normally in /var/mail/$USER, is it perhaps in
/var/mail/.$USER* ? Or if you expect it to be in /var/mail, and it
isn't, perhaps it is under /var/spool/mail or /usr/spool/mail, or in
a database?
In a procmail "BOGUS" file?
Check /var/mail (or other maildrop directory) for
BOGUS.$USER.* files. If everyone's maildrop were, say, owned
by root, then procmail will create hoardes of BOGUS.root.*
files. In this case, you may be able to use my
/dcslib/allsys/etc/whose-mbox script to guess which BOGUS files
belong to which users.
In an unusual folder?
Could the mail have been refiled to a folder that the enduser
isn't expecting the mail to be in?
Under an unexpected MUA profile?
Some MUA's have "multiple profiles", which are basically
namespaces that are specific to a particular mailserver (or
sometimes, also the method of accessing a mailserver). Check
out any profiles the user might have available, not just the
one the user is put into by default, or is in currently.
In a backup?
Hopefully there are backups to resort to, if none of the above
helped.
Sometimes you can sift through a lot of these possibilities quickly, but
asking the user for the subject line of a message that they would have
only received during the time interval during which they are missing
mail. Another possibility might be a somewhat unique sender or
recipient. Please see my "recursive
search" page for more information - it uses this sort of e-mail
searching as an example of how to do a
variety of recursive searches.
Once you locate a file or files that contain your user's mail, you
may want to pull out only messages within a given time interval or
intervals. Some tools you might use for this:
archivemail - supports IMAP, mbox, MH, and maildir.
