Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


How to do eDiscovery on an Exchange .edb file on a backup tape

Posted on 2011-05-12
Medium Priority
Last Modified: 2012-05-11
I am running Exchange 2010 SP1 and need to do an eDiscovery on a single department within the organization.  I have done that on all mailboxes as requested, but they want to go back several years to make sure that we can search mailboxes of people that have departed and whose accounts/mailboxes have been deleted.  I have backups on tapes, but they would be Exchange 2007 .edb files and i don't think that i can restore those to Exchange 2010 RDB.  I don't want to install Exchange 2007 unless that is the only recourse.  I need some ideas on restoring those database files or accessing them and then do a search for the particular mailboxes.  If there is a service that can do this for us, that would be great.  Or maybe an applicaton that might be able to extract the data from the backup tape and provide the search capabilities.  Any suggestions would be appreciated.  
Question by:jdholston
  • 4
  • 2
LVL 26

Accepted Solution

ronnypot earned 1000 total points
ID: 35752349
You cannot mount a exchange 2007 edb on a exchange 2010 server so you will have to do this with third party tools. I know this can be done by a tool called ontrack: http://www.krollontrack.com/information-management/email-management-for-exchange/email-search/

but ofcourse these tools are not free so, I don't know the price but I know you can download a trial version and see if it will work for you.
LVL 17

Expert Comment

ID: 35753687
1. What type of backup is it
2. do you still have the backup software installed and are the tapes cataloged or?
3. Located on what type of tape
4. How big is the EDB on tape?
5. How many mailboxes per tape do you have to search through?
6. How many tapes / databases do you need to search through?
7. Assuming you need to deliver the results in PST or MSG format?

There are several tools out there, just search Export from offline Exchange 2007 EDB or something like that.  

If you have a ton of tapes and the backup software is not installed, check out Index Engines http://www.indexengines.com/products_main.html?webSyncID=5d6ec280-c337-78e4-264e-6a8e57424770&sessionGUID=b81c7491-d705-4892-9b57-c80e8323a212

Author Comment

ID: 35753947
lucid8, thanks for the response.  Here is what we have:

1. It is a Symantec BackupExec backup.
2. We do have it installed, but it has been upgraded from the version that we used to backup the data.
3. LTO1 tape.  Problem is that our current backup servers are attached to a VTL and LTO4 library - we no longer have a LTO1 tape drive.
4. There are 5 mailbox stores and each is about 100G in size - we have about 4-5 tapes per backup set for Exchange when we were on Ex2007.
5. Not sure how many mailboxes per tape, but we have to search through about 120 mailboxes total - not all of them will be on each set of backup tapes depending on when the employee left the org.
6. Each set is about 4-5 tapes and we probably need to search through 10 sets of backups.
7. Not really thinking about this at this point, but i guess PST would work

Get quick recovery of individual SharePoint items

Free tool – Veeam Explorer for Microsoft SharePoint, enables fast, easy restores of SharePoint sites, documents, libraries and lists — all with no agents to manage and no additional licenses to buy.


Author Comment

ID: 35753965
lucid8 - i forgot to mention that i did look at the Index Engines link you included and it seems like a real possible solution, not only for our current situation, but also for future eDiscovery requests.  Do you have any experience with their products/services or know of anyone that might?

LVL 17

Expert Comment

ID: 35754041
Hey Johnny, no I don't have any production hands on experience with them but I have looked at the product to see how they work from competitive standpoint to our the exchange based products we develop.  Pretty cool that you can just attach a series of tape drives, pop in the tapes and ingest everything.  The only issue I had at the time was the messages and attachments were viewed separately, i.e. you didn't see the messages in native format so that you can then see the attached message and you had to do separate searches so it wasn't as intuitive as I would have liked to have seen, that said it was a few years ago so I would give it a look.

Think about all the things you want to do, ask counsel what they need etc and then give them a call, hit them up with the questions and make them show you exactly how it works.  I am sure they have a sample ingestion from an EDB that you can use to validate against via a WebEx session.
LVL 17

Assisted Solution

lucid8 earned 1000 total points
ID: 35754145
From a services based solution, I would check out http://www.renewdata.com/ they are a pretty bright bunch and they could help you either just extract the EDB's that you need from tape and then use a third party product to open, search and extract information from the Exchange EDB's once they deliver them to you, or they can extract the information from tape and then do the search for the desired information and process/export into whatever format you need.

I would give them a call and see what the cost are for both options and then you can determine the cost vs time issue and of course you need to consider the issues opposing counsel may hit you with regarding how you obtained the data, steps taken etc (aka Preservation and Collection) and Renew Data can basically give you an systematic process and audit path that should stand up nicely as to how they produced the data and there is allot to be said for that as well as the fact that it takes up allot less of your time.  I haven't used them, but have heard great things and have had some in-depth discussions regarding our Exchange tools.  They even have a nice little price estimator
LVL 17

Expert Comment

ID: 35863118
Thanks for the points and hope you resolved your issue

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Steps to fix “Unable to mount database. (hr=0x80004005, ec=1108)”.
Mailbox Corruption is a nightmare every Exchange DBA wishes he never has. Recovering from it can be super-hectic if not entirely futile. And though techniques like the New-MailboxRepairRequest cmdlet have been designed to help with fixing minor corr…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

581 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question