Even after creating a recovery database, Exchange considers the database to be in a dirty shutdown state. Therefore,
you'll need to use ESEUTIL to perform a soft recovery to prepare the database for mounting.
I opened a command prompt window and navigated to the folder containing the database. Next, I entered the dir command in PowerShell to view the folder's contents (Figure 1).
You need to know which three character log extension the database uses. If you look at the name of the E00.CHK file, you'll see that the characters are E00. Once you have these three characters, enter them with the ESEUTIL command with the /R switch.
You should be able to mount the recovery database now (Figure 2). I was able to, but only after repairing the database using the ESEUTIL /P command.
Even though I performed a soft recovery, Exchange Server still doesn't recognize my database as up-to-date (Figure 3). Repairing the database using the ESEUTIL /P command can cause data loss, so I recommend that you try to mount the database first. You should only perform a repair if the database refuses to mount.
Recovering mailbox data
After mounting the recovery database , you can begin to recover mailbox data. Figure 4 shows a single-item recovery.
The recovery uses the following command:
Restore-Mailbox –Identity User5 –RecoveryDatabase Recovery –RecoveryMailbox User5 –TargetFolder Recovery
The Restore-Mailbox command instructs Exchange to restore User5's mailbox using a recovery database named Recovery. The RecoveryMailbox portion of the command tells Exchange to place the recovered data into User5's mailbox, instead of another user's mailbox.
The TargetFolder portion of the command instructs Exchange to create a mailbox folder named Recovery and to place the recovered data there. This avoids flooding the user's mailbox with outdated items.
Exchange has placed all of the restored data into a folder named Recovery \ Recovered Data – User 5 – 2/6/2010 11:08:05 PM. Users can drag any item that they wish to recover from this folder into a mailbox (Figure 5).
In this example, I restored User5's entire mailbox. But if User5 only needs to recover a couple of messages, you can use some command-line switches to control the scope of the data you're recovering.
The –SubjectKeywords switch lets you restore messages containing a certain word or phrase in the subject line. For example, if you only wanted to recover messages with the subject line: OWA Setup from User5's mailbox, you'd use the following command:
Restore-Mailbox –Identity User5 –RecoveryDatabase Recovery –RecoveryMailbox User5 –TargetFolder Recovery –SubjectKeywords "OWA Setup"
You can recover messages containing certain words or phrases within the message body, using the –MessageBody switch. For example, if you wanted to recover messages pertaining to the Contoso project, you'd use the following command:
Restore-Mailbox –Identity User5 –RecoveryDatabase Recovery –RecoveryMailbox User5 –TargetFolder Recovery –MessageBody "Contoso"
Some users create elaborate folder structures, so it's handy to be able to focus recovery efforts on specific folders using the –IncludeFolders switch. To recover messages only from an Inbox and Calendar, for example, use the following command:
Restore-Mailbox –Identity User5 –RecoveryDatabase Recovery –RecoveryMailbox User5 –TargetFolder Recovery –IncludeFolders \Inbox,\Calendar
You can also use the –SubjectKeyword,–MessageBody and –IncludeFolders switches together to filter results even more.
About the author: Brien M. Posey, MCSE, is a six-time recipient of Microsoft's Most Valuable Professional (MVP) award for his work with Exchange Server, Windows Server, Internet Information Services (IIS), and File Systems and Storage. Brien has served as CIO for a nationwide chain of hospitals and was once responsible for the Department of Information Management at Fort Knox. As a freelance technical writer, Brien has written for Microsoft, TechTarget, CNET, ZDNet, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal website at www.brienposey.com.
Do you have comments on this tip? Let us know.