Disaster Recovery for a Single Mailbox

[Nicolas Macarez]

Hi!

I have an issue with a user who has deleted the Sent Items folder in his
mailbox (Microsoft Outlook 2003 SP2) - still less than seven days ago,
default time of retention in Exchange.

Unfortunately, he has done a hard delete (SHIFT+Del) and the registry
settings DumpsterAlwaysOn was not set prior to the disaster.
So the Recovery Deleted Items feature in Outlook is of no use.

My platform is :

Production server: Dell PowerEdge 2850 running W2K3 SP1, Exchange 2K3 SP2,
acting as a DC for the domain. Recovery Storage groups were set up a few
months ago.
Backup server with a nice backup of the System State and the Exchange
Database (37 GB), not too old.
Spare server: Dell PowerEdge 850 with a clean install of W2K3 SP1 - nothing
more.

At that step I have two options:

++ Either use the Recovery Storage Groups and use the ExMerge utility to
extract a nice PST for the user who lost his Sent Items folder.

Pros: Standard procedure
Cons: Downtime of the server (I need to dismount the First Storage Group
database). I am a bit nervous to take the risk to work on the production
server for the purpose of the recovery of a single folder of a single
mailbox of a single user...

++ Either try the following:

Since I have a spare server (Dell PowerEdge 850) I thought it would be nice
to proceed as follows:

1. Clean install of W2K3 SP1 on the spare server (same name, same IP
address, same domaine name, not connected on the LAN - of course, in order
to avoid DCs talking to each other).
2. Restore of the System State from the production server on the spare
server
3. Installation of Exchange Server 2K3 on the spare server
4. Restore of the Exchange database on the spare server
5. Extraction of the mailbox with the ExMerge utility from this new Exchange
restored database.

The issue is that my spare server is all messed up after the restore of the
System State. I do have the AD proper (users and computers) but since the
hardware is different and the registry was also restored, the server is
acting weirdly (event IE doesn't work), let alone try to install Exchange.

Am I really stuck to use the RSG?
Help appreciated.

 

[ismail]

Hi,

As far as my knowledge is concerned RSG is better option only if your server
having a good performance.
If you would like to go for recovery server then also it's ok but the only
thing is time spending....
In recovery server i will create a dummy account or any test after the
restoration of the database will take the output through exmerge... (it works)

 

[Oliver Moazzezi]

Hi,

You do not need to down your production store when restoring said store to
an RSG.. You ideally just need to make sure you have enough space to restore
the database and that your cpu/disk/ram won't be adversely affected.

Follow these steps in this how to article to save yourself the headache of
building another server:

http://www.msexchange.org/tutorials/How-Recovery-Storage-Groups-Work.html

http://www.msexchange.org/tutorials/Exchange_Server_2003_Mailbox_Recovery.html

http://technet.microsoft.com/en-us/library/bb124961.aspx

http://technet.microsoft.com/en-us/library/aa997784.aspx

http://support.microsoft.com/kb/824126


Exchange 2003 SP1 let you 'merge' the contents of an RSG mailbox into the
users production mailbox, so you don't even need the hassle of exporting to
PST seeing you're running with SP2.

Oliver

 

[Brian Tillman]

I have an issue with a user who has deleted the Sent Items folder in
his mailbox (Microsoft Outlook 2003 SP2) - still less than seven days
ago, default time of retention in Exchange.

I don't see how. The delete option isn't available for default folders.

Unfortunately, he has done a hard delete (SHIFT+Del) and the registry
settings DumpsterAlwaysOn was not set prior to the disaster.
So the Recovery Deleted Items feature in Outlook is of no use.

My platform is :

Production server: Dell PowerEdge 2850 running W2K3 SP1, Exchange 2K3
SP2, acting as a DC for the domain. Recovery Storage groups were set
up a few months ago.
Backup server with a nice backup of the System State and the Exchange
Database (37 GB), not too old.
Spare server: Dell PowerEdge 850 with a clean install of W2K3 SP1 -
nothing more.

At that step I have two options:

++ Either use the Recovery Storage Groups and use the ExMerge utility
to extract a nice PST for the user who lost his Sent Items folder.

Pros: Standard procedure
Cons: Downtime of the server (I need to dismount the First Storage
Group database). I am a bit nervous to take the risk to work on the
production server for the purpose of the recovery of a single folder
of a single mailbox of a single user...

++ Either try the following:

Since I have a spare server (Dell PowerEdge 850) I thought it would
be nice to proceed as follows:

1. Clean install of W2K3 SP1 on the spare server (same name, same IP
address, same domaine name, not connected on the LAN - of course, in
order to avoid DCs talking to each other).
2. Restore of the System State from the production server on the spare
server
3. Installation of Exchange Server 2K3 on the spare server
4. Restore of the Exchange database on the spare server
5. Extraction of the mailbox with the ExMerge utility from this new
Exchange restored database.

The issue is that my spare server is all messed up after the restore
of the System State. I do have the AD proper (users and computers)
but since the hardware is different and the registry was also
restored, the server is acting weirdly (event IE doesn't work), let
alone try to install Exchange.

Am I really stuck to use the RSG?

A lot of these questions are better asked in microsoft.public.exchange.admin

 

[Oliver Moazzezi]

I don't see how. The delete option isn't available for default folders.

I just presumed the user deleted all items _within_ the Sent Items folder.
However presuming has got the better of me before :^)

Oliver

 

[RobM]

I have seen system folders deleted before (in 5.5) when using non-outlook
clients. I'm puzzled why recover deleted items isn't working - the
dumpsteralwayson registry setting makes the recover deleted items option
available from folders other then the Deleted Items -it doesn't (afaik) make
any difference to whether the items are available for recovery or not, so
this would be worth a try. Otherwise RSG is the way to go - no need for
downtime.

 

[Andy David {MVP}]

Hi!

I have an issue with a user who has deleted the Sent Items folder in his
mailbox (Microsoft Outlook 2003 SP2) - still less than seven days ago,
default time of retention in Exchange.

The items within the folder or the folder itself?

Unfortunately, he has done a hard delete (SHIFT+Del) and the registry
settings DumpsterAlwaysOn was not set prior to the disaster.
So the Recovery Deleted Items feature in Outlook is of no use.

Sure it is. All that key does is allow you to recover hard deleted
items, it has nothing to do with the delete item retetion schedule
itself. If the item is within the retention period, its still
recoverable regardless when you add the DumpterAlwaysOn key.

My platform is :

Production server: Dell PowerEdge 2850 running W2K3 SP1, Exchange 2K3 SP2,
acting as a DC for the domain. Recovery Storage groups were set up a few
months ago.
Backup server with a nice backup of the System State and the Exchange
Database (37 GB), not too old.
Spare server: Dell PowerEdge 850 with a clean install of W2K3 SP1 - nothing
more.

At that step I have two options:

++ Either use the Recovery Storage Groups and use the ExMerge utility to
extract a nice PST for the user who lost his Sent Items folder.

Pros: Standard procedure
Cons: Downtime of the server (I need to dismount the First Storage Group
database). I am a bit nervous to take the risk to work on the production
server for the purpose of the recovery of a single folder of a single
mailbox of a single user...

++ Either try the following:

Since I have a spare server (Dell PowerEdge 850) I thought it would be nice
to proceed as follows:

1. Clean install of W2K3 SP1 on the spare server (same name, same IP
address, same domaine name, not connected on the LAN - of course, in order
to avoid DCs talking to each other).
2. Restore of the System State from the production server on the spare
server
3. Installation of Exchange Server 2K3 on the spare server
4. Restore of the Exchange database on the spare server
5. Extraction of the mailbox with the ExMerge utility from this new Exchange
restored database.

The issue is that my spare server is all messed up after the restore of the
System State. I do have the AD proper (users and computers) but since the
hardware is different and the registry was also restored, the server is
acting weirdly (event IE doesn't work), let alone try to install Exchange.

Am I really stuck to use the RSG?

Nope. If you are within the DIR schedule, implement the
DumpsterAlwaysOn key on the workstation and recover under items under
the SENT Items folder.

 

[Nicolas Macarez]

I don't see how. The delete option isn't available for default folders.

The user did select all the messages inside the Sent Items folder (CTRL+A)
and then did the hard delete (SHIFT+DEL). He thought he was doing this with
contents of the Spam folder.

A lot of these questions are better asked in

microsoft.public.exchange.admin

I did post in microsoft.public.exchange.admin.

 

[Nicolas Macarez]

The items within the folder or the folder itself?
YES


Sure it is. All that key does is allow you to recover hard deleted
items, it has nothing to do with the delete item retetion schedule
itself. If the item is within the retention period, its still
recoverable regardless when you add the DumpterAlwaysOn key.

MORE ON THIS at the end of my reply.

Nope. If you are within the DIR schedule, implement the
DumpsterAlwaysOn key on the workstation and recover under items under
the SENT Items folder.

I did set up the DumpsterAlwaysOn key that on the desktop the day after the
delete. It didn't work: I still had only the soft deleted items. I just
don't understand how the DIR feature works and how can you recover the
mails: within Outlook? Right on the server?
I need to dig a little on the point - for the next time.

 

[Andrew Dadmun]

It doesn't matter if the DumpsterAlwaysOn was set before the delete
occurred. All that does is it enabled deleted item recovery at the
client-level for non-"Deleted Items" folders.

Turn it on - restart Outlook and recover.

Regards,
Andrew

 

[Nicolas Macarez]

Thanks Oliver,
I did read these articles a few weeks ago and did some tests on a lab
server. Very useful.
I guess I'll go for the RSG.
Regards
NIcolas

 

[Andy David {MVP}]

I did set up the DumpsterAlwaysOn key that on the desktop the day after the
delete. It didn't work: I still had only the soft deleted items. I just
don't understand how the DIR feature works and how can you recover the
mails: within Outlook? Right on the server?
I need to dig a little on the point - for the next time.

Highlight the SENT Items folder, go to Tools/Recover Deleted Items.
The dumpster box should open. See if they are in there.