diff -urN exim-4.71/doc/list_frozen_queue.txt exim-4.71-patch/doc/list_frozen_queue.txt
--- exim-4.71/doc/list_frozen_queue.txt	1970-01-01 01:00:00.000000000 +0100
+++ exim-4.71-patch/doc/list_frozen_queue.txt	2010-02-22 18:41:35.966165744 +0000
@@ -0,0 +1,28 @@
+===============================================================================
+FROZEN QUEUE LISTING PATCH
+
+Author : Tony Sheen (tony_sheen<at>hotmail.com)
+
+Version: 0.00 AHS 12-Feb-2010 - Initial version
+===============================================================================
+
+This patch is designed to allow the listing of messages in a frozen queue.
+
+It is only available if the 'SUPPORT_MOVE_FROZEN_MESSAGES=yes' line has been
+uncommented in the Exim Makefile.
+
+To display the contents of the frozen queue, start Exim by adding the 'f'
+parameter to the '-bp' command.
+
+          exim -bpf
+
+This will also work if any other queue listing options are used. For example:
+
+          exim -bpfc
+          exim -bpfra
+          ...etc...
+
+It can also be invoked if exim is started as 'mailqf' on the command line.
+
+===============================================================================
+END
diff -urN exim-4.71/doc/OptionLists.txt exim-4.71-patch/doc/OptionLists.txt
--- exim-4.71/doc/OptionLists.txt	2007-08-29 14:37:28.000000000 +0100
+++ exim-4.71-patch/doc/OptionLists.txt	2010-02-22 18:41:35.967163706 +0000
@@ -614,6 +614,13 @@
 -bpra          + ... with generated addresses, unsorted
 -bpru          + ... only undelivered addresses, unsorted
 -bpu           + ... only undelivered addresses
+-bpf           + List the frozen queue
+-bpfa          + ... frozen with generated addresses as well
+-bpfc          + ... frozen but just show a count of messages
+-bpfr          + ... frozen do not sort
+-bpfra         + ... frozen with generated addresses, unsorted
+-bpfru         + ... frozen only undelivered addresses, unsorted
+-bpfu          + ... frozen only undelivered addresses
 -brt             Test retry rules
 -brw             Test rewriting rules
 -bS              Read batch SMTP on standard input
diff -urN exim-4.71/doc/spec.txt exim-4.71-patch/doc/spec.txt
--- exim-4.71/doc/spec.txt	2009-11-23 13:32:00.000000000 +0000
+++ exim-4.71-patch/doc/spec.txt	2010-02-22 18:41:35.975162737 +0000
@@ -2505,6 +2505,12 @@
 the standard libraries, symbolically linked to /usr/sbin/sendmail or /usr/lib/
 sendmail.
 
+If Exim is called under the name mailqf, it behaves as if the option -bpf were
+present before any other options. The -bpf option requests a listing of the
+contents of the frozen mail queue on the standard output. In all other ways it
+is similar to the -bp option. This name is unique to Exim and is only available
+if Exim has been compiled to move frozen messages to their own spool.
+
 If Exim is called under the name rsmtp it behaves as if the option -bS were
 present before any other options, for compatibility with Smail. The -bS option
 is used for reading in a number of messages in batched SMTP format.
@@ -2995,6 +3001,19 @@
     forwarding are not shown, unless the message was deferred after processing
     by a router with the one_time option set.
 
+-bpf
+-bpfa
+-bpfc
+-bpfr
+-bpfra
+-bpfru
+-bpfu
+
+    These options act exactly the same as those above except they list messages
+    in the frozen queue if Exim was compiled with the move frozen messages
+    option. No error is produced if these commands are used without the option
+    being compiled into Exim.
+
 -brt
 
     This option is for testing retry rules, and it must be followed by up to
@@ -13012,7 +13031,7 @@
 from the input and msglog directories on the spool to Finput and Fmsglog,
 respectively. There is currently no support in Exim or the standard utilities
 for handling such moved messages, and they do not show up in lists generated by
--bp or by the Exim monitor.
+-bp or by the Exim monitor. However, they can now be listed with -bpf.
 
 +-----------+---------+-------------+--------------+
 |mua_wrapper|Use: main|Type: boolean|Default: false|
diff -urN exim-4.71/src/exim.c exim-4.71-patch/src/exim.c
--- exim-4.71/src/exim.c	2009-11-16 19:50:36.000000000 +0000
+++ exim-4.71-patch/src/exim.c	2010-02-22 18:41:35.915159171 +0000
@@ -901,6 +901,7 @@
 #endif
 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
   fprintf(f, " move_frozen_messages");
+  fprintf(f, " list_frozen_patch");
 #endif
 #ifdef WITH_CONTENT_SCAN
   fprintf(f, " Content_Scanning");
@@ -1567,6 +1568,21 @@
   called_as = US"-mailq";
   }
 
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+  /* If the program is called as "mailqf" treat it as equivalent to "exim -bpf";
+  this is an addition to the generally accepted convention of 'mailq', but it
+  only lists the contents of exim's frozen queue. */
+
+  if ((namelen == 6 && Ustrcmp(argv[0], "mailqf") == 0) ||
+       (namelen  > 6 && Ustrncmp(argv[0] + namelen - 7, "/mailqf", 7) == 0))
+  {
+  list_queue = TRUE;
+  list_frozen_messages = TRUE;
+  receiving_message = FALSE;
+  called_as = US"-mailqf";
+  }
+#endif
+
 /* If the program is called as "rmail" treat it as equivalent to
 "exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
 i.e. preventing a single dot on a line from terminating the message, and
@@ -1837,6 +1853,18 @@
 
     else if (*argrest == 'p')
       {
+      /* Check for an 'f' after the 'p'
+         This is to list the frozen queue */
+      if (*(argrest + 1) == 'f')
+      {
+        /* Found an 'f'
+           - Ignore it if we don't have the correct compiled in support */
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+        list_frozen_messages = TRUE;
+#endif
+        argrest++;
+      }
+
       if (*(++argrest) == 'c')
         {
         count_queue = TRUE;
@@ -3752,7 +3780,17 @@
 
 if (list_queue)
   {
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+  if (list_frozen_messages == TRUE)
+  {
+    set_process_info("listing the frozen queue");
+    Ustrcpy (queue_spool_prefix, "F");
+  }
+  else
+    set_process_info("listing the queue");
+#else
   set_process_info("listing the queue");
+#endif
   queue_list(list_queue_option, argv + recipients_arg, argc - recipients_arg);
   exit(EXIT_SUCCESS);
   }
@@ -3761,7 +3799,17 @@
 
 if (count_queue)
   {
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+  if (list_frozen_messages == TRUE)
+  {
+    set_process_info("counting the frozen queue");
+    Ustrcpy (queue_spool_prefix, "F");
+  }
+  else
+    set_process_info("counting the queue");
+#else
   set_process_info("counting the queue");
+#endif
   queue_count();
   exit(EXIT_SUCCESS);
   }
diff -urN exim-4.71/src/globals.c exim-4.71-patch/src/globals.c
--- exim-4.71/src/globals.c	2009-11-16 19:50:37.000000000 +0000
+++ exim-4.71-patch/src/globals.c	2010-02-22 18:41:35.922160818 +0000
@@ -97,6 +97,8 @@
 
 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
 BOOL    move_frozen_messages   = FALSE;
+BOOL    list_frozen_messages   = FALSE;
+uschar  queue_spool_prefix[3];
 #endif
 
 /* These variables are outside the #ifdef because it keeps the code less
diff -urN exim-4.71/src/globals.h exim-4.71-patch/src/globals.h
--- exim-4.71/src/globals.h	2009-11-16 19:50:37.000000000 +0000
+++ exim-4.71-patch/src/globals.h	2010-02-22 18:41:35.922160818 +0000
@@ -57,6 +57,8 @@
 
 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
 extern BOOL    move_frozen_messages;   /* Get them out of the normal directory */
+extern BOOL    list_frozen_messages;   /* Allow frozen messages to be listed */
+extern uschar  queue_spool_prefix[3];  /* Prefix for spool name: see queue.c */
 #endif
 
 /* These variables are outside the #ifdef because it keeps the code less
diff -urN exim-4.71/src/queue.c exim-4.71-patch/src/queue.c
--- exim-4.71/src/queue.c	2009-11-16 19:50:37.000000000 +0000
+++ exim-4.71-patch/src/queue.c	2010-02-22 18:41:35.938160643 +0000
@@ -144,7 +144,12 @@
 
 /* Set up prototype for the directory name. */
 
-sprintf(CS buffer, "%s/input", spool_directory);
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+  sprintf(CS buffer, "%s/%sinput", spool_directory, queue_spool_prefix);
+#else
+  sprintf(CS buffer, "%s/input", spool_directory);
+#endif
+
 subptr = Ustrlen(buffer);
 buffer[subptr+2] = 0;               /* terminator for lengthened name */
 
@@ -267,7 +272,11 @@
     if (!split_spool_directory && count <= 2)
       {
       rmdir(CS buffer);
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+      sprintf(CS big_buffer, "%s/%smsglog/%c", spool_directory, queue_spool_prefix, subdirchar);
+#else
       sprintf(CS big_buffer, "%s/msglog/%c", spool_directory, subdirchar);
+#endif
       rmdir(CS big_buffer);
       }
     if (subdiroffset > 0) break;    /* Single sub-directory */
@@ -843,8 +852,12 @@
     FILE *jread;
     struct stat statbuf;
 
-    sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-      f->text);
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+    sprintf(CS big_buffer, "%s/%sinput/%s/%s", spool_directory, queue_spool_prefix, message_subdir, f->text);
+#else
+    sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir, f->text);
+#endif
+
     ptr = Ustrlen(big_buffer)-1;
     big_buffer[ptr] = 'D';
 
@@ -893,8 +906,13 @@
     if (save_errno == ERRNO_SPOOLFORMAT)
       {
       struct stat statbuf;
-      sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-        f->text);
+
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+      sprintf(CS big_buffer, "%s/%sinput/%s/%s", spool_directory, queue_spool_prefix, message_subdir, f->text);
+#else
+      sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir, f->text);
+#endif
+
       if (Ustat(big_buffer, &statbuf) == 0)
         printf("*** spool format error: size=" OFF_T_FMT " ***",
           statbuf.st_size);
@@ -908,7 +926,17 @@
       }
     }
 
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+    if (deliver_freeze)
+    {
+      if (list_frozen_messages)
+        printf(" *** frozen queue ***");
+      else
+        printf(" *** frozen ***");
+    }
+#else
   if (deliver_freeze) printf(" *** frozen ***");
+#endif
 
   printf("\n");
 
diff -urN exim-4.71/src/spool_in.c exim-4.71-patch/src/spool_in.c
--- exim-4.71/src/spool_in.c	2009-11-16 19:50:37.000000000 +0000
+++ exim-4.71-patch/src/spool_in.c	2010-02-22 18:41:35.950158783 +0000
@@ -52,7 +52,15 @@
   {
   int save_errno;
   message_subdir[0] = (split_spool_directory == (i == 0))? id[5] : 0;
+
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+  sprintf(CS spoolname, "%s/%sinput/%s/%s-D", spool_directory, queue_spool_prefix, message_subdir, id);
+#else
   sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
+#endif
+
+debug_printf ("File name: %s\n", spoolname);
+
   deliver_datafile = Uopen(spoolname, O_RDWR | O_APPEND, 0);
   if (deliver_datafile >= 0) break;
   save_errno = errno;
@@ -302,8 +310,17 @@
   {
   if (!subdir_set)
     message_subdir[0] = (split_spool_directory == (n == 0))? name[5] : 0;
-  sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
-    name);
+
+#ifndef COMPILE_UTILITY
+  #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+    sprintf(CS big_buffer, "%s/%sinput/%s/%s", spool_directory, queue_spool_prefix, message_subdir, name);
+  #else
+    sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir, name);
+  #endif
+#else
+  sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir, name);
+#endif
+
   f = Ufopen(big_buffer, "rb");
   if (f != NULL) break;
   if (n != 0 || subdir_set || errno != ENOENT) return spool_read_notopen;