Solved

Exchange Mail Search / Recovery

Posted on 2016-08-22
7
36 Views
Last Modified: 2016-08-25
Hello,

I wonder if anybody can help.  We've been asked by our HR dept to search and recover any emails which relate to a particular member of staff going back 2 years (section 7 data protaction act) part of this exercise requires retrieving a copy of emails from a number of current employees.

We're running MS Exchnage 2010 (DAG 2x nodes) + BE2010 for our backup solution.

My problem is, I need to be able to search not just the subject line, but body text also.  We also need to be able to retrieve emails that mention this particular employee, and I can't restore them back to the original mailbox.

What I'd like to be able to do is, restore  say 10 where we've been asked to retrieve these emails from, and restore them to an empty mailbox so we can attach to temporary accounts so we can then run a full search for any emails with reference to the employee.

Unfortunately, when attempting to re-direct the restore in BE to a new Database, the job completes successfully, but nothing is restored restored.  We can't choose the option to re-create the account / mailbox etc. as these accounts already exist.

Looking into the error logs, there are loads of exceptions with 'Skipped by user' which makes me think it could be a permissions issue.

Does anybody know if we're doing something wrong here, and indeed, is there a better way to search for emails going back several months / years.

Many thanks,

Jim
0
Comment
Question by:macleandata
  • 4
  • 3
7 Comments
 
LVL 16

Expert Comment

by:Shaik M. Sajid
ID: 41765050
did you followed the proper procedure ?

please check once

https://www.veritas.com/support/en_US/article.TECH77853

all the best
0
 

Author Comment

by:macleandata
ID: 41766652
Hi Shaik,

Thanks for replying.  Not to start with admittedly, As we've now figured out, this option is to restore the entire database, not the user's mailbox.  

We've now followed the Vertas document you've pointed us to, and we are now getting a Writer status:

Restore- \\EXCH20\Microsoft Information Store\Recovery MHMEXCH20V-79-57344-65233 - Writer Name: Exchange Server, Writer ID: {76FE1AC4-15F7-4BCD-987E-8E1ACB462FB7}, Last error: 0x800423f3, State: 0001.

V-79-57344-65233 - A failure occurred querying the Writer status.

V-79-57344-65146 - Unable to restore \\EXCH20\Microsoft Information Store\Recovery.  The existing data on the Exchange server may be an unrelated instance, or one or more incremental backups may be missing.  Verify that the complete sequence of the most recent backups are restored. If all backups are restored, then the option "Restore all transaction logs; do not delete existing transaction logs (no loss restore)" cannot apply.  Check the event logs for more information.

V-79-57344-65233 - Writer Name: Exchange Server, Writer ID: {76FE1AC4-15F7-4BCD-987E-8E1ACB462FB7}, Last error: 0x800423f3, State: 0001.

V-79-57344-65233 - Writer Name: Exchange Server, Writer ID: {76FE1AC4-15F7-4BCD-987E-8E1ACB462FB7}, Last error: 0x800423f3, State: 0001.

V-79-57344-65233 - A failure occurred querying the Writer status.

V-79-57344-65072 - Connection to the restore target has been lost.  Operation canceled.

When we're created the recovery database, we leave it unmounted so not to create the .edb / logs files.

Just to note, we are running GRT, but not sure if this should affect how we restore.  especially when we need to restore to another location.

Is there something we're missing that we can check?

Thanks for your help
Jim
0
 
LVL 16

Accepted Solution

by:
Shaik M. Sajid earned 500 total points
ID: 41766659
"Exchange server may be an unrelated instance, or one or more incremental backups may be missing. "
it seems the incremental backup are not restored properly .... for incremental you have to restore the last incremental then the data base... any how the best practice is ..

i can advise is create a VM for the complete Exchange server excluding database using backup exec and start it on any other Hyper-v machine then remount the database. here you can of any kind of testing, if any issue you can contact veritas the support at veritas is excellent. they can guide you in this regards ...

thanks
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:macleandata
ID: 41766717
Hi Shalik,

It's an incremental!!  we were working with the last backup which is actually an incremental, we started this on Thursday last week with Full backups.  Have just re-read the error logs and it's quite clear now this is the case.  

OK so have kicked off another restore from last night which is looking a lot better.  Once we happy we can retrieve emails, we can start pulling back the archives.

Looks like this is going to be fine, but I'll leave the ticket open just in case we need to query something.  Given we've missed this simple mistake, I'm sure they'll be another hurdle to jump ;-)

Thanks for your help so far

JIm
0
 
LVL 16

Expert Comment

by:Shaik M. Sajid
ID: 41766749
great keep update... thanks
0
 

Author Comment

by:macleandata
ID: 41769881
Hi Shaik,

Thanks for help with this.  We've successfully restored the various mailboxes we needed. A Good exercise to perform.

Many thanks,

Jim
0
 

Author Closing Comment

by:macleandata
ID: 41769882
Great work helping us resolve this issue!
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…
This video discusses moving either the default database or any database to a new volume.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now