That’s more information than Dovecot gives for the structure, so that will help.
Do you happen to know what the other flags mean? Examples I have: Tch Tad STad Sade Sadg RSad FRSadfi F I presume is flagged - that email (the last one) is definitely one I flagged in Apple Mail. The “fi” seems to be the waiting on the flag. I changed it and now it’s FRSadj. My guesses so far… F=Flagged R=Replied S=Seen > On Oct 19, 2015, at 6:48 PM, Bill Cole > <sausers-20150...@billmail.scconsult.com> wrote: > > On 19 Oct 2015, at 17:21, Ryan Coleman wrote: > >> Ok so it was established I don’t have a ham scan (correct). So how do I do >> it so that it only scans the read emails in a MAILDIR? > > Assuming your delivery and client access mechanisms (IMAP4/POP3/whatever) > follow standard Maildir behavior & naming, a message which has been seen by a > mail client program (i.e. marked as "read" by an IMAP4 client, maybe just > downloaded by a POP3 client, consult your IMAP4/POP3/whatever server docs & > config for the last word...) will be in the 'cur' subdirectory and its name > will match the regular expression "^[0-9]*\..*\..*:2,[A-R]*S[T-Za-z]*$" Or > looked at another way: the name will end with ':2," followed by one or more > letters in ASCII ordering (capitals first) with one of those letters being > 'S' (for "Seen"). > > (Or in shell, with a slight chance of breakage on a pathological system: > *.*.*:2,*S*)