Recovering Exchange from .OST files

Discover how one administrator cleverly managed to recover his Exchange Server data -- despite a failed hard drive, lost information store and corrupt backup -- using .OST files.

VIEW MEMBER FEEDACK TO THIS TIP

Recently, I was recruited by a colleague to help him recover Microsoft Exchange data from a failed hard drive. Unfortunately for us, he had a corrupt backup. The failed drive contained the server's private information store, so everyone's e-mail was gone and there was no backup to restore. Luckily, we were able to devise another way to recover the data (only practical in small organizations).

Microsoft Outlook maintains an Exchange Server cache that allows users to access e-mail, contacts, calendar, etc., even if Exchange is down. The caching is turned on by default, so every workstation holds a copy of its user's Exchange data.

That being the case, we decided to start a fresh Exchange installation, load the service pack, create a few mailboxes, and then let the cache data repopulate the mailboxes. It was a great plan, except for one minor detail -- Outlook 2003's built-in self-destruct mechanism.

Once Exchange was up and running, I created mailboxes for each of the users. (I had to remove the old Exchange attributes from the user accounts first.). I then logged onto a user's workstation. All of the user's e-mail was there, and I had a functional Exchange server. Life was good.

The .OST "oops" factor

I was just about to salvage the rest of my weekend when I realized that the user wasn't actually connected to the Exchange server. No big deal, I thought. I simply went through Outlook's Mail Setup dialog box, erased and retyped the username, and clicked the Check Name button.

Outlook found the mailbox on the server, and when I opened Outlook, the user was indeed attached to Exchange. To my horror though, all of the user's cached data was gone. After a few minutes of panicking, I came to my senses and started to research what had happened.

What I found was that Outlook 2003, like other recent versions of Outlook, stores the cached data in an .OST file. An .OST is similar to a .PST, except that it is intended for offline use.

What makes Outlook 2003 different from other Outlook versions is that the .OST file is bound to the currently selected Exchange mailbox. If you configure it to point to a different mailbox -- even if that mailbox has the same name as the previous mailbox -- the .OST file becomes null and void.

According to Microsoft Knowledge Base article 163589, if you modify the Outlook profile, the data in the .OST file is gone forever.

Recovering an orphaned .OST file

Needless to say, I was not a happy camper. I spent the next day researching recovery methods for a lost .OST file. I discovered that there are at least two options.

The secret to the whole recovery effort is that the .OST file itself is not actually invalidated when the profile is modified. It's just that the security code inside the .OST file no longer matches the security code used by the Outlook profile, so Outlook is configured not to accept it. In essence, there is still usable data in the .OST file. The trick is getting to it.

Before I did anything else, I backed up the .OST file. By default it is named OUTLOOK.OST and is located at C:\Documents and Settings\username\Local Settings\Application Data\Microsoft\Outlook. Once I backed up the .OST file, I began the recovery process.

The first recovery method I found is a bit pricey. There is a company named Office Recovery that makes a utility called Recovery for Exchange that can fix an orphaned .OST file so your data is accessible. The company has a version with limited capabilities that you can download for free. The demo proves that the product works (I tried it), but if you want to do any serious data recovery, you will have to shell out $600.

Since a $600 utility was not in the budget, I used another method to get the data back. A backup had been made of the machine about a week prior to the crash. I restored the backup using the overwrite option, and the cache data once again became accessible, minus the week of data that had accumulated since the backup was made.

After that, I took the .OST file I had backed up just prior to restoration and copied it to the machine's C:\Documents and Settings\username\Local Settings\Application Data\Microsoft\Outlook folder. All of the data was then available.

Once the cache data was available to me, I copied it to a .PST file. I then attached Outlook to the new mailbox, which of course invalidated the .OST file. However, since I had copied everything to a .PST, I just opened the .PST file and copied all of the data from the .PST file into the user's mailbox. When I was done, I closed the .PST file and everything was back to normal.

One last option

If you don't have a backup of the workstation with the orphaned .OST file, and you don't have $600 for a recovery utility, all is not lost. I read about another recovery method. I was not able to make it work, but you might have better luck than I did.

The idea was to rename the .OST file to OUTLOOK.PST. You are then supposed to be able to use the SCANPST.EXE command-line utility that comes with Outlook 2002 to remove the file's security header. You can then supposedly rename the file back to OUTLOOK.OST and use a utility called OST2PST to convert the file to a usable .PST. Although I was unable to make the procedure work, the OST2PST utility works great for recovering orphaned .OST files from pre-Outlook 2003 versions.

About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server and IIS. Brien has served as CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. As a freelance technical writer he has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal Web site at http://www.brienposey.com.


MEMBER FEEDBACK TO THIS TIP

I tried the following procedure to recover Exchange data from Outlook 2003:

  1. Rename the .OST file to OUTLOOK.PST.
  2. Use the SCANPST.EXE command-line utility that comes with Outlook 2002 to remove the file's security header.
  3. Rename the file back to OUTLOOK.OST and use a utility called OST2PST to convert the file to a usable .PST.

It returned an error, but I still got all the data. Although I was unable to make the procedure work, the OST2PST utility works great for recovering orphaned .OST files from pre-Outlook 2003 versions.
—Kasango JS


Do you have comments on this tip? Let us know .

Related information from SearchExchange.com:

  • Learning Center: The Exchange Server backup and recovery toolbox
  • Learning Center: All about .OST files
  • FAQ: Exchange Server backup and recovery
  • Learning Guide: Exchange Server backup and recovery
  • Reference Center: Exchange Server backup and recovery resources
  • Reference Center: Microsoft Outlook tips and resources

    Please let others know how useful this tip is via the rating scale below. Do you have a useful Exchange Server or Microsoft Outlook tip, timesaver or workaround to share? Submit it to our tip contest and you could win a prize.

  • This was first published in November 2005

    Dig deeper on Microsoft Exchange Server Backup and Disaster Recovery

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    2 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    SearchWindowsServer

    SearchEnterpriseDesktop

    SearchCloudComputing

    SearchSQLServer

    Close