Finding deleted items in an Exchange EDB file

Posted on 2012-09-19
Last Modified: 2013-03-15
We are in a situation where a few of the employees have deleted a large number of emails from a month or two ago and our backup only go back a couple of weeks.  Is there a utility to go in to the EDB file and do a undelete of items that were deleted over the course of time?  There are lots of utils that work very well on the file system but I don’t know any that can go in and recover deleted items from an EDB file.

These files that have been deleted are citical files to the well being of our company.
Question by:TIAS-TechInASec
    LVL 5

    Expert Comment

    There is no such utility or method to be able to mine the requested files.

    Author Comment

    WOW ... not good
    LVL 63

    Expert Comment

    by:Simon Butler (Sembee)
    When did they delete the items?

    Exchange does have recover deleted items which can recover items that have been Shift Deleted or Deleted from the Deleted Items folder. However that is only 14 days by default.

    If they were deleted longer than that then you are out of luck, because Exchange reuses the space they took up before it increases the physical size of the database. While the items might still be there, you would need to get a data recovery company to look at the files to see if anything can be recovered.

    Don't touch any of the recovery tools for the Exchange database that you will see advertised, most of them don't work, or will damage the database.

    Hopefully this will mean the company reviews their backup options. It is perfectly possible to configure Exchange, in combination with backups which makes it pretty impossible to lose data.


    Author Comment

    Thanks Simon,
    I have found a old backup dating back to 6-19-12 that could be extremely helpful.  With the 14 days of retention time that may get us to where we need to be.  

    I have restored the entire “First Storage Group” from backup and have all the log files and everything.  Is there an easy way to make this information available to some of our staff to look through and see if we can find the pertinent information that has been destroyed?

    LVL 63

    Accepted Solution

    There are plenty of third party discover tools that will search the information for you. However the RSG, which hopefully you have used, is designed to be used with something like EXMERGE to pull the information out for viewing in a PST file. That will include deleted item recovery content.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Live - One-on-One Exchange Help from Top Experts

    Solve your toughest problems, fast.
    Exchange experts are online now and ready to help you.

    Learn more about how the humble email signature can be used as more than just an electronic business card. When used correctly, a signature can easily be tailored for different purposes by different departments within an organization.
    Outlook Free & Paid Tools
    In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
    In this video we show how to create an Accepted Domain in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Ac…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now