I have a situation where an employee left the firm and deleted his email. Since he was a trusted employee (mistake!) no one thought to check for this until after the retention period had expired. I was asked to restore from backup and retrieve his mailbox from a previous date. For some reason I cannot complete the eseutil /r process and replay the log files. I keep getting errors:
Operation terminated with error -501 (JET_errLogFileCorrupt, Log file is corrupt) after 42.141 seconds.
The eseutil /mh reported a Dirty Shutdown and said I needed log file E0025286. I retrieved that from backup on same day, renamed it to E00.log, but got the error. So I thought, hmmmm....maybe the log file is truncated. So I checked the backup from the next day and found a log file with the same name. I tried that one, changing the name to E00.log but got the error. I then tried using the older 25286 (original file name) with the newer 25286 renamed E00.log. Got the error.
I decided screw it, I'm running a repair. But the eseutil /p priv1.edb command now comes back with an error:
Error: Access to source database 'priv1.edb' failed with Jet error -1811.
Operation terminated with error -1811 (JET_errFileNotFound, File not found) afte
r 3.94 seconds.
The .edb file is there but I notice it now has a new date stamp with today's date. I'm stumped. I'm doing all of this utility work on an external USB drive. I have performed this task once before and it worked but this time it is not going so well.