nwru
asked on
Corrupt Exchange backup
I use NTBackup / Windows Backup to backup my Exchange 2000 server's information stores and recently the drive containing them died. The drives that contain the Windows 2000/Exchange installation and archive logs are fine. When I tried to restore from the backup file (.bkf) on the same server with a new hard drive, I get the message "The backup file is unusable. You must erase it, or choose another file." and cannot continue.
The Microsoft Support article (http://support.microsoft.com/?kbid=269826) for this error is of no help. It basically says to delete your corrupted backup and "too bad" and "hahaha sucker, you should have had 'verify' turned on." Yeah, yeah, I know...now that it's too late.
All attempts to repair the .bkf file have failed. A quick googling revealed that there are several utilities that can repair suck files. I have tried four (4!) repair utilities, including "Advanced BKF Repair", "Repair My Backup", "BKFRecovery", and "Nucleus Kernel BKF", and they all have failed. They'll finish and either report that there are no files found. They'll each run for at least an hour or so, so I know they're doing something. I personally don't think that any of them are capable of handling .bkf files with Exchange information in them, only normal files and directories. I don't think any of them actually state that they can do Exchange backups.
If I hex edit the .bkf file, I can see some email information in there. Email addresses and subjects are easy to pick out in all the gibberish. I even see lots of strings that end with .eml, leading me to believe that there are just a ton of .eml files in these backups. If only I could extract them...
I have sent the physical drive out for professional data recovery as recommended by others on EE (https://www.experts-exchange.com/questions/21783520/Disk-crash-Invalid-partition-Unusable-backup-file.html), but if they can't help me, I better be able to make something of this backup file. The CEO of my company is really on my back about retrieving some irreplaceable emails and contacts.
So my question is: Is there any way to salvage Exchange information from a "corrupt" .bkf file or are there any utilities that can actually repair my file?
One more thing. I have archive logs going back 50 days. If can't get back the original information store, is there any way to play back the archive logs on an empty store to get _something_ back? I have tried remounting one of the offline stores and it automatically runs through all the archive logs (as shown in the application log), but after an hour, no .edb/.stm files are created and an nondescript error message is displayed.
Thanks in advance!
The Microsoft Support article (http://support.microsoft.com/?kbid=269826) for this error is of no help. It basically says to delete your corrupted backup and "too bad" and "hahaha sucker, you should have had 'verify' turned on." Yeah, yeah, I know...now that it's too late.
All attempts to repair the .bkf file have failed. A quick googling revealed that there are several utilities that can repair suck files. I have tried four (4!) repair utilities, including "Advanced BKF Repair", "Repair My Backup", "BKFRecovery", and "Nucleus Kernel BKF", and they all have failed. They'll finish and either report that there are no files found. They'll each run for at least an hour or so, so I know they're doing something. I personally don't think that any of them are capable of handling .bkf files with Exchange information in them, only normal files and directories. I don't think any of them actually state that they can do Exchange backups.
If I hex edit the .bkf file, I can see some email information in there. Email addresses and subjects are easy to pick out in all the gibberish. I even see lots of strings that end with .eml, leading me to believe that there are just a ton of .eml files in these backups. If only I could extract them...
I have sent the physical drive out for professional data recovery as recommended by others on EE (https://www.experts-exchange.com/questions/21783520/Disk-crash-Invalid-partition-Unusable-backup-file.html), but if they can't help me, I better be able to make something of this backup file. The CEO of my company is really on my back about retrieving some irreplaceable emails and contacts.
So my question is: Is there any way to salvage Exchange information from a "corrupt" .bkf file or are there any utilities that can actually repair my file?
One more thing. I have archive logs going back 50 days. If can't get back the original information store, is there any way to play back the archive logs on an empty store to get _something_ back? I have tried remounting one of the offline stores and it automatically runs through all the archive logs (as shown in the application log), but after an hour, no .edb/.stm files are created and an nondescript error message is displayed.
Thanks in advance!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I'll check that out right away. Thanks!
ASKER
So I managed to get 2 or 3 information stores out of that .bkf file (priv1, office1, and office2). Office3 was in that backup file too, but apparently is gone now. No big deal really, since it wasn't important. Now I'm having difficulty restoring these files. With a new hard drive and plenty of space, I have to make something out of two .edb/.stm file pairs (office1 and office2), one .edb with a possibly incomplete .stm file (priv1), and all the transaction log files that I should need. So I ran eseutil /mh to see what I have:
E:\Exchsrvr\mdbdata>eseuti
State: Dirty Shutdown
E:\Exchsrvr\mdbdata>eseuti
Last Consistent: (0x3E13,358,1B9) 02/03/2006 10:38:09
So The "State: Dirty Shutdown" is a little disappointing, considering this store was backed up and restored without any problems. Also, as far as I know, the "Last Consistent: (0x3E13,358,1B9) 02/03/2006 10:38:09" is odd too. The backup is dated 3/12/06, so why does that say 2/3/06? Hopefully, this won't matter since I have transaction logs going back to 2/1/06.
Since I can regenerate these .edb and .stm files, I figure I'll experiment with a few things, as I don't know exactly what I'm doing. I stick the files back into their original location (and the log files are still in their original location) and try to mount the Office1 store through Exchange System Manager. No errors pop up right away, so I watch the application log:
ESEUTIL (3156) The database engine 6.00.6487.0000 started.
ESEUTIL (3156) The database engine is initiating recovery steps.
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
...
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
ESEUTIL (3156) Attempted to attach database 'e:\exchsrvr\mdbdata\priv1
ESEUTIL (3156) Database recovery/restore failed with unexpected error -544. (Event Type: Error, Event Source: ESE, Event Category: Logging/Recovery, Event ID: 454)
ESEUTIL (3156) The database engine stopped.
and a message box stating:
An internal processing error has occured. Try restarting the Exchange System Manager or the Microsoft Exchange Information Store service, or both.
ID no: C1041724
Exchange System Manager
So this didn't do the trick. Restarting both Exchange System Manager and the Microsoft Exchange Information Store service didn't make a difference. I guess I need to do something more drastic. For reference, the last attempted log file, E0003E13.log is dated 2/3/06 10:45 AM, close to the "Last Consistent" date/time of the office1.edb.
I assume that can't do eseutil /cc because I don't have a restore.env file. (per MS KB article)
I try a eseutil /r. I don't believe that I have a checkpoint file, so I just put E00 anyway. The /i switch is just in case it complains about not being able to find the lost Office3.edb and Office3.stm.
E:\Exchsrvr\mdbdata>eseuti
Initiating RECOVERY mode...
Logfile base name: E00
Log files: g:\exchsrvr\tranlogs
System files: <current directory>
Database Directory: e:\exchsrvr\mdbdata
Performing soft recovery...
Operation terminated with error -544 (JET_errSoftRecoveryOnBack
But how can I do "restore" if I don't have a restore.env? Application log shows the same entries as when I tried to mount via Exchange System Manager above.
So I'm at a loss as to where to go from here. Any recommendations?
E:\Exchsrvr\mdbdata>eseuti
State: Dirty Shutdown
E:\Exchsrvr\mdbdata>eseuti
Last Consistent: (0x3E13,358,1B9) 02/03/2006 10:38:09
So The "State: Dirty Shutdown" is a little disappointing, considering this store was backed up and restored without any problems. Also, as far as I know, the "Last Consistent: (0x3E13,358,1B9) 02/03/2006 10:38:09" is odd too. The backup is dated 3/12/06, so why does that say 2/3/06? Hopefully, this won't matter since I have transaction logs going back to 2/1/06.
Since I can regenerate these .edb and .stm files, I figure I'll experiment with a few things, as I don't know exactly what I'm doing. I stick the files back into their original location (and the log files are still in their original location) and try to mount the Office1 store through Exchange System Manager. No errors pop up right away, so I watch the application log:
ESEUTIL (3156) The database engine 6.00.6487.0000 started.
ESEUTIL (3156) The database engine is initiating recovery steps.
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
...
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
ESEUTIL (3156) The database engine has begun replaying logfile g:\exchsrvr\tranlogs\E0003
ESEUTIL (3156) Attempted to attach database 'e:\exchsrvr\mdbdata\priv1
ESEUTIL (3156) Database recovery/restore failed with unexpected error -544. (Event Type: Error, Event Source: ESE, Event Category: Logging/Recovery, Event ID: 454)
ESEUTIL (3156) The database engine stopped.
and a message box stating:
An internal processing error has occured. Try restarting the Exchange System Manager or the Microsoft Exchange Information Store service, or both.
ID no: C1041724
Exchange System Manager
So this didn't do the trick. Restarting both Exchange System Manager and the Microsoft Exchange Information Store service didn't make a difference. I guess I need to do something more drastic. For reference, the last attempted log file, E0003E13.log is dated 2/3/06 10:45 AM, close to the "Last Consistent" date/time of the office1.edb.
I assume that can't do eseutil /cc because I don't have a restore.env file. (per MS KB article)
I try a eseutil /r. I don't believe that I have a checkpoint file, so I just put E00 anyway. The /i switch is just in case it complains about not being able to find the lost Office3.edb and Office3.stm.
E:\Exchsrvr\mdbdata>eseuti
Initiating RECOVERY mode...
Logfile base name: E00
Log files: g:\exchsrvr\tranlogs
System files: <current directory>
Database Directory: e:\exchsrvr\mdbdata
Performing soft recovery...
Operation terminated with error -544 (JET_errSoftRecoveryOnBack
But how can I do "restore" if I don't have a restore.env? Application log shows the same entries as when I tried to mount via Exchange System Manager above.
So I'm at a loss as to where to go from here. Any recommendations?
ASKER
Seems that I misread some documentation. Since I didn't restore my database files from NTBackup, I couldn't utilize the "Last Restore Set" check box, so I need manually do a hard recovery. I haven't yet figured out how to do that though.
ASKER
After doing everything that I could think of, I tried a repair (eseutil /p) on the store and that finished successfully. Now I'm having trouble doing a recovery (eseutil /r), probably because I have over 3000 log files to apply here and the limit is 1008. All of these logs will need to be applied, one way or another. Is there any way to do maybe 500 at a time? Every method that I have tried gets errors.
Once you do a hard repair of the database (eseutil /p) you will not be able to apply any logs.
ASKER
Yeah, I just found that out. MS said that you "may" not be able to apply them anymore. I threw the repaired files into a folder and am working on the original ones again. Thanks though.
ASKER
I think I may have figured it out. I'll know for sure tomorrow.
ASKER
Looks like PowerControls did the trick. The ExtractWizard was able to extract several .edb and .stm files from the invalid .bkf file, even though one of them ended prematurely I believe. Fortunately, the important ones came through just fine, so I was able to open them with PowerControls. I initially had some problems when I tried to use all of the transaction logs, but after I trimmed off a few from the end, it worked great. Restoring about 40GB of emails box-by-box, folder-by-folder took a few days, but was worth it. My butt has again been saved thanks to you guys :)
nwru, wondering what technique you used with PowerControls for getting files out of the corrupt BKF file ? did you do anything special ? I have a similar issue with a corrupt BKF file with exchange data that I would like to get out, nothing works and even PowerControls gives me the error "No Valid Exchange Information Store data was found." and doesnt get any farther.
ASKER
Hi kasowitz. Sorry for the late reply. My memory is hazy, but I don't believe that I did anything special with the PowerControls settings. I'm pretty sure it just worked.
Best of luck with the situation. I know it can be a terrible thing to go through.
Best of luck with the situation. I know it can be a terrible thing to go through.
ASKER