<

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x

Mailbox Recovery Exchange 2010

Published on
48,173 Points
33,173 Views
15 Endorsements
Last Modified:
Awarded
Community Pick
In previous versions of Exchange Server, we had the recovery storage group, or RSG, which allowed us to restore a copy of the EDB file associated with the Mailbox Database and recover individual mailboxes or mail/calendar/contact items.

In Exchange 2010, we no longer have Storage Groups and therefore no Recovery Storage Group.  Instead we have the Recovery Database.  This Recovery Database can only be mounted on one server at a time.  As Mailbox Databases are not linked to servers they can be mounted on any server within the same Exchange Organisation.

Following on from my article here: http://www.experts-exchange.com/articles/Software/Server_Software/Email_Servers/Exchange/Backing-up-Exchange-2010-Information-Store-using-Windows-Backup.html  where we discussed how the Windows Backup Utility can be used to backup just the EDB and LOG files.  We will now look at how we can use this to restore the EDB file and recover the contents.  We will cover the following:

Restore the EDB & Log files
Create a Recovery Database from the EDB file
Use the ESEUTIL utility to replay the log files
Recover the required mailbox/mail items

Restore the EDB & Log files

Using the Windows Server Backup utility (Start > Administrative tools), in the action pane on the right hand side, select Recover.
On the first screen, select the backup location as per the image below.  If you have the backup stored on another drive on the same server then select This Server, otherwise select A backup stored on another location and click Next.
 restore-01.jpgThe next screen you see (image below) will be asking you the location of the backup you want to restore.  Choose either Local drives or Remote shared folder.  Click Next.
 restore-02.jpgMake your selection and click next.  On the following screen you will have to provide the location of where the backup is stored.  This will be different depending on the location you specified on the previous screen.  Locate your backup and click next.
The next screen will be the date selection that you want to restore from (image below).  Select the date from the calendar and the time the backup was taken, and then click next.
 restore-04.jpgSelect the files and folders option from the following screen (there is no need to restore the full volume) and click next.  You will see a full list of files and folders as displayed below.  You need to select the files from the list.  Make sure you select all the contents of the folder where the mailbox store is stored.  Including the log files.
 restore-06.jpgOnce you have made the selection, click next. The following screen will ask you where you want to store the recovered data.  Complete the detail and then click next.  On the final screen click recover.

Create a Recovery Database from the EDB file

Once we have restored the EDB file and Log files, we then need to create a Recovery Database.  This process can only be performed using the Exchange Management Shell.
Assuming the following Information:
Servername is WIN2008R2 (must be an Exchange Server that holds the Mailbox Role)
The EDB & Log files have been restored to C:\EDBRestore\
EDB File Name is Mailbox Database 2012387847.edb
The recovery database name will be RecoveryDatabase1
Run the following command in the Exchange Management Shell:
 New-MailboxDatabase -Recovery -Name “RecoveryDatabase1” -Server WIN2008R2 -EdbFilePath “C:\EDBRestore\Mailbox Database 1.edb" -LogFolderPath "C:\EDBRestore"

Open in new window

Once you run this command you will see an output similar to the image below.
 new-mailboxdatabase.jpgThis will create the Recovery Database.  We can confirm the database has been created and that it is a recovery database by running the following command from the Exchange Management Shell:
Get-MailboxDatabase

Open in new window

This will display an output similar to the image below.
 get-mailboxdatabase.jpgThe important part of this screenshot is that the database listed as RecoveryDatabase1 has the value of True under the Recovery setting.

We now have a recovery database created.  The next step is to replay any log files we have to bring the store up to date.

Use the ESEUTIL utility to replay the log files

The EDB file we have restored will not include any data that is contained in the log files as these are committed to the database AFTER we perform the backup.

The utility we use to perform the replay is ESEUTIL, this utility is the same in all versions since Exchange Server 2000.

We need to know the log file numbering before we can run ESEUTIL.  To do this, navigate to the folder you restored the EDB & Log files to (in the case of this article it is C:\EDBRestore) and look for the file that starts with an E and has 2 numbers after the E and an extension of .chk, so for example E00.chk.  This is what is known as the checkpoint file, or the working log file.  All the other log files will start with the same 3 digits and they are created when the checkpoint file gets full.

So assuming your checkpoint file is called E00.chk we now need to run the command to replay the log files in the Exchange Management Console.
Once the Exchange Management Shell is open type the following commands:
Cd \ <enter>
CD EDBRestore
ESEUTIL /R E00 /I /D

Open in new window

This will replay the log files that you have restored from the backup into the database.  

The final part of this step is to mount the Recovery Database.  To do this we run the following command from the Exchange Management Shell:
Mount-Database RecoveryDatabase1

Open in new window

We are now in a position to restore the required data.

Recover the required mailbox/mail items

Unlike previous versions of Exchange, there is no Graphical User Interface for the recovery process.  To recover mail items we need to use the Exchange Management Shell.

So for example, we have a user called mark_wills and he has deleted the entire contents of his mailbox and you need to recover all his mail.

We have a copy of the mailbox belonging to mark_wills in our Recovery Database.  To restore the required mailbox, we would use the Exchange Management Shell and run the following command:
Restore-Mailbox -Identity mark_wills -RecoveryDatabase RecoveryDatabase1

Open in new window

This will recover a mailbox called mark_wills from the Recovery Database called RecoveryDatabase1 to the mark_wills mailbox in the live database.  This method relies on the original mailbox still being in tact.
The next option is to recover the mark_wills mailbox from the Recovery Database and place it into a folder called "mark_wills Recovery" within a mailbox called tigermatt.
Restore-Mailbox -Identity tigermatt -RecoveryDatabase RecoveryDatabase1 -RecoveryMailbox mark_wills -TargetFolder “mark_wills Recovery”

Open in new window

We also have the ability to search the mailbox content for keywords.  In this example we search for any messages containing the word “demazter” and restore those items to a folder called “mark_wills recovery with demazter text” within a mailbox called alanhardisty.  To do this we would run the following command:
Restore-Mailbox -Identity alanhardisty -RecoveryDatabase RecoveryDatabase1 -RecoveryMailbox mark_wills -SubjectKeywords "demazter" –TargetFolder “mark_wills recovery with demazter”

Open in new window

15
Author:Glen Knight
11 Comments

Expert Comment

by:Tpm1973
hello,

i have already done all this, but my problem is the last point:

Recover the required mailbox/mail items

i don't want to restore the mailbox to a "subfolder" in a existing other mailbox;
or overwrite/merge my origional mailbox, ...

i want't to restore/export my mailbox to a .PST file.

thx!
0
LVL 17

Expert Comment

by:lucid8
Unfortunately you have to run through the restore process first to an existing live mailbox and only then can you export the data to PST.

Troy Werelius
0
LVL 12

Expert Comment

by:Asif
If I am wrong please correct me.
E00.chk keeps info about the logs that has been written to database, is it really the current log file to which data is written when exchange is online?
If its not the current log then I will request you to please correct it in the article.

Thanks.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

LVL 74

Author Comment

by:Glen Knight
wasim-shaikh,

You are correct, the checkpoint file keeps the information about what log files have been committed to the database.

The sentence you are refering to "All the other log files will start with the same 3 digits and they are created when the checkpoint file gets full." does need to be re-worked.  The flow of the previous sentence must have got away with me.

I will update the article as soon as I can.

Thanks
demazter
0

Expert Comment

by:kitsao
hi,
I have corrupted mailbox databases (errorcode 1018) and no Backups of it. Is there any chance to recover it?

I'm moving all e-mail the users already have from their mailboxes to pst's and then I'll re-install Exchange 2010. So I think the loos won't be too big.

Is that a good idea?
0

Expert Comment

by:kitsao
hi,

Created a new mailbox database and solved the problem!

Thanks!
0
LVL 17

Expert Comment

by:lucid8
Excellent
0
LVL 23

Expert Comment

by:Justin Durrant
Great article!
0
LVL 16

Expert Comment

by:Carol Chisholm
could we have NewMailboxRestoreRequest too?
0

Expert Comment

by:taisweb
Can this be used to restore Contacts?

Restore-Mailbox -Identity “fname lname" -includefolders “\Contacts” -RecoveryDatabase RDB1 -RecoveryMailbox “fname lname" -TargetFolder Recovery

The command runs for about 1 second, creates a folder in \Recovery\Recovered Data - Fname Lname - 09/12/2012 11:37:15  however the folder is empty.

Is there anything special needed to restore the Contacts folder?
0

Expert Comment

by:datatechdc
see attached screenshot. i am getting an error regarding New-MailboxDatabase
recoveryerror1.png
0

Featured Post

Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
This video tutorial shows you the steps to go through to set up what I believe to be the best email app on the android platform to read Exchange mail.  Get the app on your phone: The first step is to make sure you have the Samsung Email app on your …

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month