Start Free Trial

asked on

Recover Exhange mailbox for a user who has left firm.

A user has left the firm and we need to go back and search for some old emails. When a user leaves we create a pst file and store this for times like this. The problem is the user has deleted a number of emails. I have a backup from the week before she left using the SBS exchange backup. Is there any way to restore this data so we can search it now there is no user in AD?

Hi,

By default mailbox deletion retention is 30 days. Check if the mailbox is there in disconnect mailbox by running the command clean-mailboxdatabase -name "db name"

http://technet.microsoft.com/en-us/library/bb232039%28EXCHG.80%29.aspx

If the mailbox is not there in disconnected mailbox then go for backup restore.

You can restore the backup in Recovery Storage Group and then recover the user from adrestore.net or through ldap. And then reconnect the user mailbox to user.

http://www.msexchange.org/tutorials/Working-Recovery-Storage-Groups-Exchange-2007.html

Hi,

check this one

http://www.microsoftnow.com/2008/05/recovering-single-exchange-2007-mailbox.html

You can create a recovery storage group in exchnage 2007 and restore a backup.
The use restore command to restore mails to the folder in any of the users mailbox.

I recommend to create a test user and then restore mail to that users mailbox.. it will create a folder in the test users mailbox...

Good options from the other members and another option would be to obtain a 3rd party tool that can open an offline backup of the exchange database so that you can view, browse, search for specific items as well as hard and soft deleted items and then export to PST or MSG. Just search from something like "Export Hard and Soft deleted item and mailbox from Offline Exchange Database"

ASKER

Thanks for info. I keep getting an error when trying to mount the database as per instructions.

I've only mounted the first storage group, should I mount the second, or am I missing something?

Which instructions are you following specifically and what is the error you are receiving?

ASKER

the msexchange.org ones.

When mounting the database it says
Error encountered while trying to mount the database (Mailbox Database) in the recovery storage group (Recovery Storage Group). Error message is: Exchange is unable to mount the database that you specified. Specified database: SVR01\Recovery Storage Group\Mailbox Database; Error code: MapiExceptionCallFailed: Unable to mount database. (hr=0x80004005, ec=-550)

1. Where did you get the database from, i.e. did you recover it direct from backup to the RSG?
2. What is the result if you run ESEUTIL /MB "DatabaseFileName.edb"

NOTE: Enter the actual EDB name between the ""

ASKER

The database is a the backup from the built in nightly backup of the server

That eseutil doesn't seem to work? Or it asks for defragmentation etc?

Doh looked a little closer at the error code and -550 means the Database is in DirtyShutdown mode, i.e. the logs have not been rolled up so..

1. To validate this you can use eseutil /mh as described above and you should see that the database is in a dirty shutdown state.

2. When you recovered the database did you also recover the logs?

2. a if so then use the recovery mode of eseutil http://technet.microsoft.com/en-us/library/bb123479%28EXCHG.80%29.aspx to roll the logs and bring the database to a clean shutdown state. You might have to try two or three times. Once the database says it's in a clean shutdown state you should be able to remount.

2. b Now if you don't have the logs then I would go back and try to recover the database again and ensure you get the logs

3. If the logs are just not available then you need to do a repair against the EDB using eseutil /p "DatabaseFileName.edb"

NOTE: Enter the actual EDB name between the ""

After running eseutil /p you should also run isinteg -s servername -fix -test alltests against that database and repeat until there are no errors reported as fixed. NOTE: don't worry about the Warnings. http://technet.microsoft.com/en-us/library/bb125144%28EXCHG.80%29.aspx

NOTE: eseutil /p can be a destructive process which deletes bad database pages so be sure you are not working on your only copy - isinteg corrects links issues after this.

4. Mount in RSG

Doh sorry meant /MH

ASKER

mh says failed with jet error -1811

1. Where are you running the command from?
2. What is the actual path of the DB?
3. you may need to wrap the location in double quotes i.e. eseutil /mh "c:\program files\exchsrvr\mdbdata\priv1.edb"

ASKER

I was running if from wrong directory. Ran from correct and it says operation completed successfully.

All logs etc are in the folder.

oh whats the state, i.e. clean, dirty?

ASKER

Ah. it does say dirty shutdown

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

I can run this on an Exchange server that is currently being used by other users? Or is it best to wait until they have logged off?

Also would this command be the one to run?

ESEUTIL /R Enn /A

1. No you don't need to wait for others to log off since you are working with an offline EDB and it will have no effect on online databases since you are not referencing any online files

2. Yes that would be the command but you don't need the /A unless you are dealing with LLR http://technet.microsoft.com/en-us/library/bb123919(EXCHG.80).aspx and more specifically here on LLR http://smtp25.blogspot.com/2007/05/eseutil-in-exchange-2007-and-lost-log.html

ASKER

It keeps coming up with
operation terminated with error -528

Whats the exact command you are running?

Where are the logs you recovered located ?
Where is the database you recovered located?

ASKER

Running ESEUTIL /R Enn /A
Logs and revovered data all in folder on D drive where I'm running command from too.

just try running "Eseutil /R Enn /I /D" where nn will actaully be 00 or 01, 03 etc. Look in the directory and see if you have a E00.log or E01.log and then use the appropriate command i.e. if E01.log exist then you would do a Eseutil /R E01 /I /D

ASKER

Running that command worked. It now says clean state under shutdown. But I still get the error when trying to mount the database.

ok the command should be different at this point, please give me the exact error message it spits out

ASKER

Error encountered while trying to mount the database (Mailbox Database) in the recovery storage group (Recovery Storage Group). Error message is: Exchange is unable to mount the database that you specified. Specified database: SVR01\Recovery Storage Group\Mailbox Database; Error code: MapiExceptionCallFailed: Unable to mount database. (hr=0x80004005, ec=-550)

Move the logs etc into a sub directory away from the EDB and try again

ASKER

Thank you. I've got the database mounted. I now have a problem recovering the mailbox. As I said the user had left, so I recreated the user thinking it needed a mailbox to recover too? I now have the following error

Error restoring the mailbox (/O=FIRST ORGANIZATION/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=USERNAME). Error message is: The specified mailbox "defb48ce-035a-4b7f-ac97-5ee2a2144530" does not exist on database "SVR01\Recovery Storage Group\Mailbox Database"..

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

Thank you. Without this I would be stuck.

Glad to assist and thanks for the points