Technology · PRACTICAL GUIDE
Thunderbird Local Folders disappeared? Audit mbox files before importing
A read-only CSV ledger can show what survived without changing the only profile copy you may have.
Missing Local Folders are not one problem. Thunderbird may be opening a different profile, the old profile may still contain extensionless mbox files, or only indexes and partial IMAP cache data may remain. The wrong first move is copying files into a live profile before you know which state you have.
This guide uses a bounded read-only inventory before any import. It preserves every candidate’s origin, hierarchy, size and SHA-256, labels only the evidence visible in the bytes, and stops when profiles or destination names collide. It does not promise recovery and it never modifies the inspected copy.
A useful recovery decision begins with provenance: which profile, which storage tree, which exact bytes and which uncertainty. Once the ledger distinguishes actual mbox-like candidates from indexes, hierarchy containers, empty folders and cache-only IMAP evidence, you can choose the smallest reversible next step.
Keep the original backup, the audited copy, the CSV and the script hash together. If identity remains ambiguous, preserve rather than merge. A delayed careful import is cheaper than overwriting the only surviving mail store.
Start with a copy, not the profile Thunderbird is using
Close Thunderbird before collecting anything. Mozilla’s migration guidance treats the profile as application data that should be copied while Thunderbird is not running, and its profile documentation warns against opening the same profile from multiple places. Make a complete, trusted copy of every candidate profile directory to ordinary local storage. Keep the original backup unchanged and run the audit only against the copy.
If an update made mail appear to vanish, open Thunderbird only long enough to note the active profile in about:profiles, then close it again. A different installation profile can make intact data look missing. Record every profile path you found rather than assuming the newest-looking directory is the right one.
Know what the files can—and cannot—prove
Under a profile, Mail usually contains POP accounts and Local Folders, while ImapMail belongs to IMAP accounts. Thunderbird commonly stores an mbox folder as a file with no extension. A sibling .msf file is an index that Thunderbird can rebuild; it is not the message store. A directory ending in .sbd represents subfolder hierarchy and must be kept with the related folders.
Those naming patterns are clues, not proof. An empty extensionless file may represent an intentionally empty folder. Another extensionless file may be unrelated binary data. An ImapMail tree may contain only indexes or a partial offline cache, so its presence cannot prove that every server message is recoverable. The audit therefore records format evidence and uncertainty instead of declaring every candidate safe to import.
Run the bounded read-only inventory
Save the supplied thunderbird_mbox_audit.py on a machine with Python 3. Put the output CSV outside the copied profile tree and choose a filename that does not already exist. The script refuses symlinks, refuses more than 10,000 source files, refuses to overwrite a report, and takes byte, size, nanosecond-mtime and SHA-256 snapshots before and after scanning.
Run: python3 thunderbird_mbox_audit.py "/path/to/offline-copy" "/path/to/new-audit.csv". The program walks Mail and ImapMail without modifying them. It counts mbox-style From separators, looks for common message headers near those separators, records SHA-256, pairs extensionless candidates with .msf files, preserves .sbd ancestry and groups candidates by a case-folded destination key.
Read the CSV as an evidence ledger
Treat each row as a statement about one path, not as an import instruction. profile_root tells you which candidate profile supplied the row. storage_tree distinguishes Mail/Local Folders, POP account trees and ImapMail accounts. relative_path and sbd_parent preserve hierarchy. size_bytes and sha256 let you prove whether two candidates are byte-identical or merely share a name.
The risk label mbox-like-evidence-not-proof means the file contains at least one mbox separator plus a nearby common header; it still needs manual review. extensionless-no-mbox-evidence means do not import based on the missing extension. empty-extensionless-candidate needs a folder-history check. rebuildable-index identifies .msf. hierarchy-container-not-message-data identifies .sbd. A same-destination-name-collision means at least two extensionless candidates would compete for the same destination identity and the script deliberately refuses to choose.
Separate Local Folders from IMAP cache evidence
A plausible file under Mail/Local Folders is the strongest candidate for a disappeared local-only folder. A plausible file under another Mail account can still matter, but its account identity should be recorded before any move. For ImapMail, distinguish downloaded message bytes from index-only artifacts and remember that an offline cache can be incomplete. If the server account still exists, compare with the server before treating cached files as the authoritative archive.
Do not count .msf rows as messages. Do not use a nonempty ImapMail candidate to infer the total message count on the server. Do not merge profiles because their folders have familiar names. Where candidates collide, keep both files and their hashes, identify the originating profile and account, and design a reversible rename or separate test import later.
Choose a bounded next action
If the active profile is simply wrong, the smallest next action may be selecting the correct profile rather than importing anything. If a complete old profile is known-good, follow Mozilla’s full-profile transfer guidance with Thunderbird closed and compatible application versions. If only selected local mbox candidates remain, work on another disposable profile and use Thunderbird’s documented import boundary; do not replace the live Local Folders tree during diagnosis.
Stop when identity is ambiguous, a source copy changes during the scan, the report shows collisions, the only evidence is .msf, or the material exists only as an uncertain IMAP cache. Preserve the CSV, source-copy hash, script hash and original backup. This audit does not repair corrupt mbox bytes, deduplicate messages, recover server-only mail, or guarantee that Thunderbird will accept a candidate.
Evidence decision matrix
Observed state | What it supports | What it does not prove | Safest next action
about:profiles shows another plausible profile — Mail may only appear missing because Thunderbird opened a different profile — That the other profile is complete or current — Close Thunderbird, copy both profiles, audit each separately
Extensionless file with separators and headers — Mbox-like evidence worth reviewing — That every message parses or belongs to the intended folder — Keep hash-pinned; inspect and test only in a disposable profile
.msf without matching extensionless file — An index artifact survived — That message bodies survive locally — Do not count it as recoverable mail; check backups or server
.sbd directory with child candidates — Subfolder hierarchy evidence — That the parent mbox is present or valid — Preserve hierarchy and audit each child candidate
ImapMail candidate — Some account cache data may exist — That all server mail was downloaded — Compare with the server; do not treat cache as a complete archive
Same destination collision — Two profiles or trees claim the same logical name — Which candidate should replace the other — Keep both, identify origins and plan separate imports or renames
Frequently asked questions
Can I delete .msf files to recover the folders? An .msf file is a rebuildable index, not the underlying message store. Deleting indexes may force Thunderbird to rebuild them when the related mbox exists, but it cannot recreate missing message bytes. Preserve a copy and identify the extensionless store first.
Does every extensionless file under Mail contain messages? No. Thunderbird mbox files are often extensionless, but the absence of an extension is only a clue. Size, separators, headers, path context and manual inspection all matter; the script labels evidence without asserting validity.
Can I import directly into my live Local Folders? Do not use the live profile as the diagnostic workspace. Keep Thunderbird closed while copying, retain the original backup, and test selected candidates in a disposable profile only after the audit resolves identity and collisions.
Will ImapMail recover messages deleted from the server? Not reliably. An IMAP profile may contain indexes, partial cached bodies or stale data. Inventory can show local evidence, but it cannot prove completeness or restore messages that were never downloaded.
