A community admin, Daquantics, is investigating a harassment complaint where a user claims to have received negative private messages (PMs) that are no longer available. Daquantics is unsure if users can delete PMs in a way that admins can’t see them.
jomaxro and codinghorror both confirm that admins can see all content, including deleted PMs, and users cannot self-delete topics or PMs. Mittineague suggests using the Data Explorer plugin to investigate, which would show if the messages were deleted and by whom.
Mittineague provides a query example to retrieve the private messages between two users, and later notes that even after 24 hours, admins can still see hidden replies with edit revision history.
tobiaseigen mentions that admins can view all PMs, and notes that the term “private messages” was previously used, but has since been changed to “personal messages” to clarify that they are not secure.
I am admin for our community and I have a user complaining about harassment from another user. They said they received negative messages and PMs, but could no longer find the messages.. They copy-pasted a quote they said they found in an email notification.
At first, I thought this person (the complainant) was confusing email notifications about public threads with private messages, but the interactions between the two users in public didn’t match the forwarded quote, and hadn’t been edited.
Moreover, the quotes didn’t appear in the “accused” user’s deleted posts, nor in their private messages (sent, archived, inbox).
So, I’m confused. Is it possible for users to send Private Messages, then delete them in a way that Admins can no longer see them?
I know there is no block function for the complainant to use, but before we have a word with the “accused” guy, I wanted to see the actual messages.. I’ve asked the complainant to forward me the emails, but some clarification would be great.
Not that I’m aware of. Admins can see everything on the site, even deleted content. Users cannot self-delete topics, only posts. PMs, while different from a public topic, are still inherently topics that users cannot self-delete. Check staff logs? Perhaps another staff member deleted them?
On my localhost I had SpamGuy2 message TestUser3. (it wasn’t pretty)
There was no option for SpamGuy2 to delete the first post / the topic
TestUser3 could have Flagged offensive posts, but for whatever reason didn’t
SpamGuy2 edited one of his posts and deleted another
TestUser3 could view edit revision history via the pencil
AdminGuy1 got the user id values (14, 58) from the Admin → Users URLs and hard coded them into this query
WITH user_one_topics AS (SELECT topic_users.topic_id
FROM topic_users
WHERE topic_users.user_id = 14)
, user_two_topics AS (SELECT topic_users.topic_id
FROM topic_users
WHERE topic_users.user_id = 58)
SELECT topics.id AS topic_id
FROM topics, user_one_topics, user_two_topics
WHERE user_two_topics.topic_id = user_one_topics.topic_id
AND topics.id = user_two_topics.topic_id
AND topics.archetype LIKE 'private_message'
By clicking on the link in the query result he could see the message
* note, this is before the “automatically deleted in 24 hours unless flagged” has elapsed.
what outbound mail service do you use? with mandrill I can look up and see the notifications for the last 3 months from my discourse.
incidentally, there was a renaming at some point from “private messages” to “personal messages” to make clear that these are not actually private and secure messages and members shouldn’t treat them as such. Admins can see them all.
you’ve all been super helpful, as usual. Much appreciated.