Accidently deleted public calendar Exchange Server 2003. Can I recover from rollback logs?

I am an IT professional (but don't feel like one today!!) (20+ years experience but not with Exchange) I had a Microsoft certified tech working for me that said we could burn a copy MDBDATA to a cd with the E*.log files and then delete all but the E00.log file logs. (This server didn't have a tape drive or Veritas installed on it.)  He had about 4-5 years "experience" with Exchange at another firm, but he told me he "lost" their Exchange data for their server too and had "learned his lesson". (this should have tipped me off) He also configured one of our clients Exchange 2003 Servers, and after he left our employ, I realize he had NOT purchased the Exchange agent for Veritas, when the log files filled up their drive and were not being deleted after the nightly backup. (he also had the log files located on the C: drive instead of another larger drive!!!)  

I mention the above because of what I did next on OUR Exchange 2003 server at the downtown office. Today, I drug a COPY (right click, drag, copy)  of the public calendar to the Public Folder Favorites. Later I reduced the window size so I could drag this to the desktop and create a shortcut. For some other reasons, I decided to delete the shortcut. No problem. Then I looked at Public Favorites and clicked on the "copy" of the calendar. No problem. Then I clicked on the Public Folder "main" calendar and displayed it. No problem. I decided to delete the copy under the Public Favorites and this is where disaster struck! The opsys message indicated something about deleting everything. I said cancel. The system paused, and suddenly the main Public Calendar was gone. I immediately burned a DVD copy of the Exchsrvr folder and subfolders to DVD before doing anything else. I have several "backups" on DVD's of MDBDATA from the end of last month. I have E*.log files on the Exchange Server disk drive currently that are dated 8-11-04 through 05-04-05. (I have not been deleting the log files since August of 04. I know that I need to install a tape drive on this server at the downtown office and install Veritas with the Exchange Agent. (I was making some hardware changes in the two office locations and was putting off installing these items on this server.)) Is there a way to rollback / recover this really "brain-dead" delete I did earlier today?
"Necessity isn't the mother of invention, desperation is, and I am there!" Thank you very much in advance for your assistance! I'll be monitoring this the rest of the day.
Who is Participating?
PAQ'd, 500 points refunded.
Community Support Moderator
Oh my, the lessons we learn.

You could try to bring back the public folder database that you made at the end of last month.
BUT you don't want to log files to play back in. That would recreate the deletion. Also in anticipation of a question you may ask, you cannot edit the log files to remove the deletion of the public folder.

Here are the steps:
1. Stop the Information Store service. This will cause all the uncommitted log files to be committed to the databases.
2. MOVE all the E*.log files ito a secure location. Also MOVE the EDB.CHK file to the secure location. Also move the PUB1.EDB and PUB1.STM to the secure location.
3. Copy the PUB1.EDB and PUB1.STM files you backed up last month into the proper MDBDATA folder.
4. Launch the Exchange System Manager. Mark the Public Folder store so that it can be restored.
5. Start the Information Store service. Make sure that the databases mount.

The problem with doing these steps is that anything that has been added or deleted to the public folders since the backup will not be there.

Hope this helps.
dpcorpConsultantAuthor Commented:
Ok, thanks for that response. I had one more question/idea as per the above steps.
point 4. "Mark the Public Folder store so that it can be restored." - where is this setting?

But, my main question ... after doing above procedures with the "backup" DVD MDBDATA from last month, can I drag the "calendar" public folder up to the private area. Then do this same procedure, but copy back step #3 for DVD copy I just made after my original deletion today? Then drag the private calendar folder back down to the public area so I don't lose any other public documents changed since 4-2-05? This will not (?) change any private emails under this login....correct? Comments?????

Thanks for quick response. I am going back to other office to look for more current  DVD backup. Hoping I have only a couple of days of loss. DVD I located, was 4-2-05!! not EOM as I thought.

Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

"Mark the Public Folder store so that it can be restored."
In the Exchange System Manager, go to the properties of the Public Folder Store. There is a check box on the General Tab.

Well I hope I understand what you mean, here goes....

After you follow my steps above, you can copy the contents of the public folder to a PST file. Do this using Outlook.
Then you can stop the information store service again and go thru the steps again except this time place the original databases in the proper folder.
After you start the services again you can recreate the Public folder and copy the contents from the PST file into the folder.

I hope this is what you mean.
dpcorpConsultantAuthor Commented:
Ok, I got the calendar recovered but not by doing the process we discussed. I had looked at a question on Q_20991908 with a title of "Deleted Outlook Public Folder". It mentioned that the "limits" tab specified a "Keep deleted items for (days):" field. Ours was set to 7 days. (I changed it to 30 since we don't have a lot of deletions and have the space to do so.)  (Exchange System Manager>Administrative Groups>First Administrative Group>Servers>servername>Public Folder Store ... right click ... Properties ... click Limits tab) That made me question if a recovery process would work, instead of restoring the old data of 4-2-05. In the Microsoft Exchange Server 2003 Administrator's Pocket Consultant by William R. Stanek (c) 2004, page 254-255, there is a section on "Recovering Public Folders"  The steps were as follows: abreviated:

1. Log on to domain with admin priv.
2. Start Outlook, access pub folders node, select All Public folders node or node that contained the pub folders.
3. Select Recover Deleted Items from the Tools menu. (there I saw the Calendar with a deleted date and time of 5-4-05 12:09pm
4. I selected this folder and clicked Recover Selected Items
5. The Calendar folder restored with the word (Recovered) appended to it.
6. I renamed it back to the original name

I checked the calendar ... all items seemed to be accounted for correctly .... Success!!!!
I immediately backed up the MDBDATA area after shutting down the Exchange services. (I assume Information Store is the only one I really need to shut down, but am not sure of this.)

I don't know exactly how to award points in this case. I need to run now, but will log in tomorrow to award some of these points.

Well since you resolved your issue in a different way than I suggested, then you should ask for a refund on your points.
Post at the following link asking how to get a refund:

Glad you were able to recover your data. Have a good day.
No objection here. Please refund the points.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.