Scenario 1 (Online Backup)
Online Backup was performed on Monday Night 10:00 PM, but Exchange server crashed the next day @ 4:00 PM. Now at the time of restoration, beside restoring the last online backup, we must replay those log files which were created since last backup.
Checking available Log files
Before starting the restoration, please check if all available transaction log files are stable! To check the same, execute the following command from Log files folder (I am considering log files of Default/First Storage Group hence mentioning E00; please update the command if log files are of a different storage group).
"eseutil /ml E0X"
This will tell you if all log files are stable! If any of the log file is damaged, you will not be able to play all log files that are falling sequentially after that log file.
i.e. out of 100 log files; if 75th log file is damaged/missing – it will not play all log files from 75 till 100!!
Online Restore
When we start online restoration (Ntbackup or any Exchange Backup third party software) of backup, please ensure you have not selected any check box “Last Restore Set” and “Mount database after restore”.
Please select temp path which will have backed up log files during online backup process.
As well as do not forget to select checkbox – “This database can be overwritten by a restore” from ESM – Mailbox Store Properties –Database Tab.
Verifying completed restoration
Once restore is completed, please check the restore.env file and restored log files in mentioned Temp location as well as take the backup of the entire temp folder. When replay starts and restored log files are played, the process deletes the restore.env file. If restore process fails and we need to start replaying log files again, to get the restore.env, you can copy it from backup location or you will need to complete the restoration again!!
Execute “eseutil /cm command to read the restore.env file (http://support.microsoft.
Replaying Log files
From same path execute eseutil/cc to start reply of the log files. It will read the restore.env and will play restored log files first.
After completing replay of restored log files; it will start looking for log files on path of storage group. The entire log file process with fail when either log files are damaged or there is some issues with Disk I/O.
Once all log files are completed replaying you can mount the database.
Scenario 2 (Offline Backup)
Offline Backup was performed on Monday Night 10:00 PM, but Exchange server crashed next day @ 4:00 PM. Now at the time of restoration, besides we are restoring last offline backup; we must replay those log files that were created since the last backup.
Checking available Log files
In this case log files, which are created before the offline backup, are no longer needed and you can move them to other path or delete them!!
Check the log files created after the backup using eseutil /ml.
This will tell you if all log files are stable! If any of the log file is damaged, you will not be able to play all log files that are falling sequentially after that log file.
i.e. out of 100 log files; if 75th log file is damaged/missing – it will not play all log files from 75 till 100!!
Offline Restore
Dismount the stores which we want to restore and select checkbox – “This database can be overwritten by a restore” from ESM – Mailbox Store Properties –Database Tab.
Replaying Log files
Since this offline restore and no restore.env, we can simply mount the database or can run “eseutil /r E00” to perform soft recovery.
More about offline backups - http://support.microsoft.c
Scenario 3 (databases recovered by restoration of online/offline backup but available log files were not played)
Many times Administrators forgot or ignore replaying log files that are created since the last backup. Once restoration is completed and users find their recent emails are missing, administrators realizes that they have ignored/forgot to replay log files that are created after last backup.
If you have only 1 Exchange Database the task is easy or else you will have repeat these steps to recover all databases.
Recovery Storage Group
In exchange 2003; MS has introduced this concept when we need to restore the mailbox of single user or multiple users without investing in test environment or disturbing entire mailbox store/server.
Create Recover Storage Group (http://support.microsoft.
Checking available Log files
Before starting the restoration, please check if all available transaction log files are stable! To check the same; execute following command from Log files folder (I am considering log files of Default/First Storage Group hence mentioning E00; please update the command if log files are of different storage group).
"eseutil /ml E0X"
This will tell you if all log files are stable! If any of the log file is damaged – you will not be able to play all log files that are falling sequentially after that log file.
i.e. out of 100 log files; if 75th log file is damaged/missing – it will not play all log files from 75 till 100!!
Online Restore
When we start online restoration (Ntbackup or any Exchange Backup third party software) of backup; please ensure you have not selected any check box “Last Restore Set” and “Mount database after restore”.
Please select temp path, which will have backed up log files during online backup process.
As well as do not forget to select checkbox – “This database can be overwritten by a restore” from ESM – Mailbox Store Properties –Database Tab.
Verifying completed restoration
Once restore is completed; please check the restore.env file and restored log files in mentioned Temp location as well as take the backup of entire temp folder. When replay starts and restored log files are played, the process deletes the restore.env file. If restore process fails and we need to start replaying log files again – to get restore.env can copy it from backup location or need to complete the restoration again!!
Execute “eseutil /cm command to read the restore.env file (http://support.microsoft.
Preparing to replay the log files
Copy the required log files on Recovery Storage Group Log files path. Rename copied log files to start from R00xxxxx.log so that those will be recognized while replay. From command prompt you can execute DOS command “ren e00* to R00*”.
Replaying Log files
From same path execute eseutil/cc to start reply of the log files. It will read the restore.env and will play restored log files first.
After completing replay of restored log files, it will start looking for log files on path of storage group. The entire log file process with fail when either log files are damaged or there is some issues with Disk I/O.
Once all log files are completed replaying you can mount the database.
Merging the recovered mailboxes
Once databases are mounted and if you have E2K3 SP2 - you can merge recovered mailboxes into production mailboxes. Or you can also export them in PST using Exmerge. (http://support.microsoft.
Happy restoring!! :)