Two-phase expunge (1)


Expunge "moves" messages to shadow folder
file stays in same place; indexes changed
folder -> .EXPUNGED/folder

Delete moves folders to hidden namespace
added timestamp to uniquify name
.DELETED/folder-20040226-12:34:56
.EXPUNGED/.DELETED/xy-20040226-12:34:56

Users can recover deleted email themselves
however hidden namespaces are confusing
unexpunge and undelete admin tools