Finding deleted items in an Exchange EDB file

We are in a situation where a few of the employees have deleted a large number of emails from a month or two ago and our backup only go back a couple of weeks.  Is there a utility to go in to the EDB file and do a undelete of items that were deleted over the course of time?  There are lots of utils that work very well on the file system but I don’t know any that can go in and recover deleted items from an EDB file.

These files that have been deleted are citical files to the well being of our company.
TIAS-TechInASecAsked:
Who is Participating?
 
Simon Butler (Sembee)ConsultantCommented:
There are plenty of third party discover tools that will search the information for you. However the RSG, which hopefully you have used, is designed to be used with something like EXMERGE to pull the information out for viewing in a PST file. That will include deleted item recovery content.

Simon.
0
 
m3mph1s1Commented:
There is no such utility or method to be able to mine the requested files.
0
 
TIAS-TechInASecAuthor Commented:
WOW ... not good
0
 
Simon Butler (Sembee)ConsultantCommented:
When did they delete the items?

Exchange does have recover deleted items which can recover items that have been Shift Deleted or Deleted from the Deleted Items folder. However that is only 14 days by default.

If they were deleted longer than that then you are out of luck, because Exchange reuses the space they took up before it increases the physical size of the database. While the items might still be there, you would need to get a data recovery company to look at the files to see if anything can be recovered.

Don't touch any of the recovery tools for the Exchange database that you will see advertised, most of them don't work, or will damage the database.

Hopefully this will mean the company reviews their backup options. It is perfectly possible to configure Exchange, in combination with backups which makes it pretty impossible to lose data.

Simon.
0
 
TIAS-TechInASecAuthor Commented:
Thanks Simon,
I have found a old backup dating back to 6-19-12 that could be extremely helpful.  With the 14 days of retention time that may get us to where we need to be.  

I have restored the entire “First Storage Group” from backup and have all the log files and everything.  Is there an easy way to make this information available to some of our staff to look through and see if we can find the pertinent information that has been destroyed?

>ME
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.