Estimate the true mean: given only measurements above a known threshold I have a computer-generated logfile which shows events which took longer than a particular time threshold (say 1 second for the sake of argument): if I measure the mean of these measurements, it seems this mean value will be 'off' because of the unreported measurements that didn't hit the threshold value.
Is there a standard way of re-adjusting the mean to take into account these missing values that failed to meet the threshold : and what assumptions need to be made in order to carry this out ?
 A: This is a standard case of truncated data (not to be confused with censored data). So you need to consider density and distribution functions.
Since your variable, call it $Y$, reflects time intervals, it will be non-negative. Denote the threshold level above which we get data as $t^*$. Call $Y^*$ the truncated random variable which ranges in $[t^*, \infty]$. Then it is standard that
$$f_{Y^*}(y^*) = \frac {f_Y(y)}{F_Y(y\ge t^*)}= \frac {f_Y(y)}{1-F_Y(y\le t^*)}$$
where $f()$ is a pdf and $F()$ is a cdf.
Then $$E(Y^*) = \int_{t^*}^{\infty} \frac {yf_Y(y)}{1-F_Y(y\le t^*)}dy $$
while
$$E(Y) = \int_{0}^{\infty} yf_Y(y)dy  = \int_{0}^{t^*} yf_Y(y)dy+\int_{t^*}^{\infty} yf_Y(y)dy$$
Combining we obtain
$$ E(Y) =  \int_{0}^{t^*} yf_Y(y)dy+E(Y^*)\left[1-F_Y(y\le t^*)\right]$$
So you need to make assumptions for the distribution that your untruncated variable follows. If you know how many incidents are not reported then you can approximate $F_Y(y\le t^*)$ by the ratio "Unreported / Total". This step will also simplify your life regarding the estimation of $f_Y(y)$: even if you assume a distribution for it, sensibly you will only assume the family, not the exact parametrized density.
The likelihood function of a sample of $m$ incidents, assuming independence and identical distribution, will be
$$L = \left(f_Y(y)\right)^m\left[1-F_Y(y\le t^*)\right]^{-m} $$
and the log-likelihood
$$\ln L = m\ln f_Y(y)-m\left[1-F_Y(y\le t^*)\right] $$
If $F_Y(y\le t^*)$ is estimated as mentioned above, it becomes a constant and you have only to estimate the parameters of the distribution by using the assumed density functional form (such a tactic may be helpful if the cdf is not closed-form and/or difficult to estimate, so it will stress the estimation algorithm). 
Once you obtain estimates of the distribution parameters, you have an estimate of the density with values for its parameters - and then you can go back to the expression for $E(Y)$ and obtain an estimation of the untruncated mean. $E(Y^*)$ can be estimated directly by the available data as the truncated sample mean, but you can also obtain an alternative calculation for it using the estimated density, and the expression for $E(Y^*)$ above: comparing these two estimates for $E(Y^*)$ will give you some idea on how reliable your estimation results are.
