I have never had this happen, nor have I heard of it happening to anyone else. I'm sure it HAS happened, but I don't think it's a common problem with Thunderbird.

My first thought is to blame an anti-virus program, which very well could have, rightly or wrongly, detected a virus in the mail fold file. It might have quarantined the file. Can you check your AV, if any, to see its recent action and if it has moved anything into quarantine?

A moral of this story, which I see you already know, is to backup your Profile regularly!

Thanks for the good ideas.

Co-incidentally, antivirus did quarantine a threat around that time. However, a scan of the restored file itself was virus free, and antivirus allowed me to copy and open it without intervention. So that is unlikely to be the explanation. In addition, Windows Defender logs tell me it was a trojan in files that another user downloaded. That user does not have permission to access my AppData files.

The other point is this was a copy of my sent mail folder. Anything in it I generated, I inserted from a file that was in my system and already scanned, or I replied to or forwarded. The first two categories could not have been infected. The third could, but only if an incoming message was infected, and in that case the inbox should have been quarantined.

Now that does bring up an odd coincidence. Yesterday, my inbox was corrupted. The index was pointing to the wrong messages. I fixed that, but did not think it could be related to what has happened. I don't know if a specific message triggered the issue, and I routinely delete unimportant messages, so it would be hard to recreate the situation.

So: it is barely possible that an incoming message somehow evaded detection both by gmail and my antivirus (Windows Defender). It then trashed my sent mail folder some time after I sent it on to unsuspecting others. Very far fetched. Do you have any other thoughts?

Thanks.

There could be false positive detections made at any time, even if the file was previously OKed. Unlikely in this case, but possible, I think. The only other things that would arbitrarily trash a folder would be malware or disk corruption due to a failing disk.

This is not a recommendation exactly, but I consider it to be an acceptable risk to exclude my Inbox folders from real-time scanning. A malicious attachment is only likely to act if you if you make the choice to run it. I know better than to do that, though of course, not everybody would.

From the datestamp, I know when the file was overwritten. I've checked my system logs, and nothing untoward happened at that time, although the log does record system shutdown ten minutes later. So I am baffled about what might have happened, as I doubt the shutdown process took more than a few seconds.

Hope it's not my hard "disk," which is one of the thoughts you had. Somewhere there is a utility to check quality of these solid state drives. If I can find it, I'll run it, but the computer is pretty new.

Learning experience.

Thanks for the help!

There are a bunch of S.M.A.R.T reporter programs that will read the drive's built-in health logs. I use "Crystal Disk Info" ( https://crystalmark.info/en/ ). This works for both SSDs and magnetic disks.

I also once in a while, run in a Windows administrator CMD session "CHKDSK /F" to fix file system anomalies.

It happened again!

According to file date stamp, it was overwritten late yesterday morning. At that time TB was open, but I was not accessing the file. Discovered it yesterday evening when searching for old mail.

Here is additional information. No other file in that directory has been disturbed. There are about 6 of them. The directory is a subdirectory of ..\mail\local folders\ named "current." There are other subdirectories in the structure with identically named folders that have not been disturbed...yet. For example. ..\mail\local folders\archives\2024\sent.

"Sent" is also the name of an ImapMail file. No other file in that folder duplicates an ImapMail file name.

I am suspicious that there is some operation targeting ImapMail that is incorrectly hitting my current folder. As a test, I have a second copy of the sent file in the same folder, renamed to SentCopy. I can't think of anything else to do at the moment, and I will wait to see what happens.

Any other suggestions?

Did you exclude your folders from scanning by your AV?

Have you thoroughly scanned your computer for malware?

Check the Retention Policy for that folder. Select the folder name in the list, right-click, choose Properties from the context menu, Retention Policy tab. There are settings there that could automatically purge some or all messages, There are also similar per-account settings in Account Settings | Synchronization & Storage.

Didn't know about retention policy--thanks. It was set same as all other folders "use my account settings." Those are "Don't delete any messages." So that's not it. I will scan the whole system for virus and malware overnight.

In the meantime, I discovered that both copies of the folder (the original and the copy) were erased at 8:40 this evening. No other file in the folder was erased. I restored the file and did a file repair. Nothing happened. Then I did a manual compress on the file. Zeroed it out. Tentative diagnosis: something weird in the file that repair can't detect that causes compress to quit midway through.

Temporary fixup: I set the file to read only. It's an archive, so I never expect to change it. Of course, if compaction is the problem, I may get an error when it tries to execute. Meanwhile, I am watching a file that I have on the same drive in a directory not associated with TB to see if it gets tampered with.

I'll report the scan results in the morning. I think I may be close to understanding what's happening, although not why.

Thanks.

If both the original and copy disappeared, I can only think that Defender took it.

- Check again to make sure Defender is set to quarantine suspected files, not to delete them. Check to make sure the missing files are not in quarantine.

- Manually virus scan your backup copy.

- Did you exclude your folders from scanning by Defender?

- One way to determine if one particular message in the folder is infected, you could export all message in the folder to individual EML files, then scan them all. An infected one might even be caught by Defender as it's written to disk.

- Consider uploading the file to VirusTotal for a thorough scan by several AVs. They will accept files up to 35 MB. You can zip it up to be smaller.

https://www.virustotal.com/gui/home/upload

- If you suspect that the file is corrupt and can't be compacted, copy all messages to an newly created folder. That should resolve the corruption.

Virus scan is negative. I have a stalking horse in another location that will tell me if something like Defender is doing it. I have not yet excluded the folder from scan for exactly the reason you said, even though I am pretty careful on line. That will be my last resort after I try everything else you've suggested.

I'm copying the messages to a new folder now. Should thunk of that!

Thanks. This is getting tiring, but it is a great learning experience.

After copying the messages, file is slightly shorter (59,900 vs 64,045 Kb). Compacting the new file did not damage it.

Tentative conclusion: corrupted file.

I'm going to remove read only from the original. If it disappears in a few days, then you have SOLVED my problem.

Thanks so much!

Followup: TB wiped out the original file, but not the version with the messages copied in.

Conclusion: Corrupt file that caused compaction to fail mid-operation.

Problem solved, THANKS!

If any TB developer would like to look at or test the corrupt file to see what happened, I have retained a copy that I could post. Since y'all are busy and this is a rare occurrence, I am not expecting anyone to take up the offer, but I thought I'd ask.