We were testing the PST importer and a co-worker used a very large PST file with sensitive data to test with. I have read that deleting the mail will actually remove it from the file system. However I will need to prove that the data is gone.

Here are my questions

1) Does zimbra store messages on the disk according to an account or will messages be intermixed within the various sub directories of the store?

2) How can I prove that it was actually this data that was deleted from the mail store directory?

3) What is the best way to delete this mail? Just have the user account delete it or us zmmailbox command line utility?

If so how do I delete all messages for a single account with this command line utiltiy?

The help on this CL utility is scarce. When I searched on it I saw a post (related to deleting with a date range) that said this:

The easiest way to do this is probably to use the zmmailbox command.

First, run search "in:inbox (after:1/15/07 before:2/15/07)". (Make sure that these are actually the messages you want to delete before proceeding!) Then collect the results of that search and run deleteMessage id1,id2,id3,... where the ids are the ones returned from the search.
Now how does a newbie know to do this? Does this search have to be done within zmprov or some other CL function.