SBS 2011 Standard : Exchange 2010 Single Message Restore

sbsstdDuring a recent SMB MVP Community Roadshow event in Edinburgh, a member of the audience asked us about Email restore in SBS 2011.

Although i knew this could be done, i had never actually done it. So i decided to work out how it was done with SBS 2011.

I found a lot of great resources online that helped me with the process and i have linked to them at the end of this post.

I’m focusing on a situation where we are restoring from a backup, rather than what is available through the Exchange dumpster (aka Recover Deleted Items) although i do cover that briefly below.

So this is the email i decided to accidentally delete and then try to restore.

Email

As you can see this is a really important email i got from John Lennon, so i don’t want to delete it.

If i accidentally deleted it, and it was not in my Deleted Items, what can i do?

I can use Recover Deleted Items, which we can access through OWA.

Right Click Deleted Items, and notice the bottom option is to Recover Deleted Items..

Recover

This will open up a new window where you can browse the contents of your Dumpster and recover anything you didn’t mean to delete.

RecoverDeleted

Make sure to select the email you want to recover, then hit the email icon with the blue arrow.

You can then choose which folder to recover the email into, and click the Recover button at the bottom.

RecoverDeletedToFolder

You may find that the required email is not available in ‘Recover Deleted Items’ this can occur after the deleted items retention period has expired, or if someone accidentally clicks the delete button, not the recover button as described above.

This is the scenario in which you would want to restore your Exchange from backup.

(so for the purposes of this post you will have to assume i have accidentally deleted this email and that it is not available through recover deleted items.)

Recover Your Database

First of all we need to restore our Exchange database, of course that requires that we actually have a backup.

Luckily the built in SBS 2011 Backup can help us here, Loading up the SBS Console, and switching to the Backup and Server Storage tab, we can click on “Restore Server Data from Backup”

ConsoleRestore

The Windows Server Backup application will load up, in the top right you can choose to ‘recover..’

WSB-Restore

The Recovery Wizard will launch and you have the choice of whether to choose a backup stored on the local computer, or on another location. The default for SBS will be a backup stored on this server. Click Next

RestoreWiz

Next choose the date that you want to restore from, and click next.

RestoreWiz2

Because SBS 2011 backup links into Exchanges’ VSS Writers, we can chose to restore Exchange as Application, rather than restoring the data files individually.

Select Application and click next.

RestoreWiz3

You then have the choice of whether to restore Exchange or SharePoint. Seeing as this a post about Exchange, it is safe to assume you want to select Exchange.

RestoreWiz4

(you also have the choice of whether or not to roll the database forward, if you selected the most recent backup. In 2003 days a Roll Forward backup was explained as: "Roll forward" restoration. The log files that were created after the backup are played into the database. If all of the log files are available, all of the data that was created after the backup can be preserved. If circular logging is enabled, you must perform a "point in time" restoration of your offline backup; you cannot choose a "roll forward" restoration)

As we are restoring along side the production database and not doing a full BMR (Bare Metal Restore) of the entire Exchange server, tick the box to prevent the roll forward, and click next.

RestoreWiz5

The next step is quite important, well i say quite important, i mean Exceptionally Important.

Very, very, very important.

Please choose to ‘recover to an another location’ then click Browse, to find a folder on the Server to restore the Exchange to. I have put a ‘Recovery’ Folder on my desktop to make it easy to find the recovered folders.

RestoreWiz6

RestoreWiz7

Clicking Next will show you a summary page showing which Information Store items will be restored, and to which location.

RestoreWiz8

Clicking Recover, starts the recovery process.

RestoreWiz9

Remember at this point we are recovering the Entire Exchange Database so make sure you have adequate disk space.

RestoreWiz10

Check Shutdown State Of Database

Depending on the size of your Database the restore may take quite some time to complete. Once it has completed, browse to the folder that contains your restored Database EDB file. You will notice that the restore procedure has restored into an identical folder tree structure.

Recover-Folder

Recover-Folder2

Hold Down Shift, and Right click some free space, and choose Open Command Window Here.

We are going to use Eseutil to check the shutdown state of the database. It is likely the database is in a dirty shutdown state and that we will need to run recovery to bring it to a clean shutdown state.

Recover-Folder3

Enter the following command in the command prompt.

ESEUTIL /MH “Mailbox Database.edb”

eseutil2

In the resulting readout, scroll up to see the Database Shutdown State line. If the state shows as Dirty Shutdown we will need to run a recovery command, if it shows as Clean Shutdown you can skip this step.

eseutil4

We can also check the status of the Transaction Logs using another switch to the Eseutil command.

ESEUTIL /ML <path to logs folder and log prefix>

ESEUTIL /ML “c:\users\dfunk\desktop\recovery\c_\program files\Microsoft\exchange\v14\mailbox\mailbox database\E00”

eseutil5

eseutil6

Perform Soft Recovery of Database

To run recovery we need to run the following command.

ESEUTIL /R E00 /D <path to database folder>

In my example the database files were restored to c:\users\dfunk\desktop\recovery\c_\program files\Microsoft\exchange\v14\mailbox\mailbox database\

So my recovery command would be:

ESEUTIL /R E00 /D “c:\users\dfunk\desktop\recovery\c_\program files\Microsoft\exchange\v14\mailbox\mailbox database”

eseutil7

eseutil8

Your database should be recovered to a clean shutdown state, and you can run the previous Eseutil command (/MH) to check for the state.

eseutil10

Once you have the database in a clean shutdown state, we need to create a Recovery Database (RDB).

Create a Recovery Database

In Exchange 2003/7 we would create a Recovery Storage Group which we could do through the Exchange Management Console. In Exchange 2010 we must use the Exchange Shell to create a Recovery Database.

Load up the Exchange Shell and enter the following command.

New-MailboxDatabase –Recovery –Name RDB1 –Server SBSSERVER

(you can specify the location for the database and log files with other switches, but the above command will create the RDB with the default locations for Logs and Database)

exshell2

Once the database has been created we need to set the allow file restores flag to true.

Set-MailboxDatabase –AllowFileRestore:$True –Identity RDB1

exshell4

Now we need to move our restored database to the folder our RDB database is looking at and rename the database file “Mailbox Database.edb” to “RDB1.edb”.

Go to the location of your restored Exchange database, and find the EDB file. Copy this file, and only this file, to the location of your RDB. (the default will be C:\Program Files\Microsoft\Exchange ServerV14\Mailbox\RDB1)

copy

copy2

copy3

Mount the Recovery Database

We can now mount the database using the following command:

Mount-Database RDB1

mount

To check the database has been mounted successfully (assuming you didn’t get an error in the Shell) you can Load the EMC and navigate to Organization Configuration, Mailbox, you should see in the mounted column if the database is mounted or not.

emc

We can then run this command to read the database and tell us which mailboxes are present, you probably wouldn’t need to do this in most cases, as you will only have one database but in environments with multiple databases it might be useful to verify you have actually got the right database mounted.

Get-MailboxStatistics –database RDB1

recover-get-stats2

Finally we can actually recover some email.

Recover Deleted Items

In my Example i have deleted an email from a user called John Lennon which i would like to recover. As i showed at the start of the post, it was a really important email. It also contained the word ‘important’, so i can use the ‘AllContentKeywords’ switch to help find it.

Restore-Mailbox -Identity dfunk –RecoveryDatabase rdb1 –allcontentkeywords "important"

restore-message

Restore-Mailbox is the CMDLET to use, Identity selects which mailbox to recover, RecoveryDatabase selects which database to recover from, and AllContentKeyWords allows me to select a keyword that was present in either the subject or the body.

The read out from the Exchange Shell should show you if this was a success or not, but as you can see from OWA, the message is restored almost instantly for me.

restore-message3

restored

Using a keyword like this can be useful especially if a user is not 100% sure on what the email contained or who sent it, but it may have the unhappy side effect that it restores not only the desired email, but every email that contains that keyword. Luckily there are some other options we can use with our restore command, i am not going to cover them all but i will cover the Target Folder option, I’m also changing from using AllContentKeywords to SenderKeywords

Specifying a target folder, tells the restore process to put the restored items into a folder you name. This allows us to account for a potential large number of email being restored without causing too much further disruption to the user.

The syntax of our command would change slightly to include a different switch, –TargetFolder

Restore-Mailbox -Identity dfunk –RecoveryDatabase rdb1 –TargetFolder “inbox\_recovery” –senderkeywords "John Lennon"

reccover-folder50

You are then prompted to enter the display name of the source mailbox

reccover-folder51

reccover-folder52

Switching back to OWA we can now see our Target Folder command has built a folder sub tree, and in two folders we have unread items, which are our restored emails.

reccover-folder53

reccover-folder55

reccover-folder54

There are a lot of variables in situations where you will want to restore email, variables in the information you have to work with, and also on how specific you want to be when issuing your recovery commands. The links below show how you can use dates to target the restore as well as using the keywords i have shown in my examples.

Hopefully this has been useful.

 

Related Links

You can refer to the links below for more detailed syntax for the Restore-Mailbox command and for more info on the restore process.

Restore-Mailbox

http://technet.microsoft.com/en-us/library/bb125218.aspx

Explaining Single Item Recovery In Exchange 2010

http://blogs.technet.com/b/exchange/archive/2009/09/25/3408389.aspx

Explaining Single Item Recovery In Exchange 2010 Continued

http://blogs.technet.com/b/exchange/archive/2010/04/26/item-recovery-in-exchange-2010.aspx

TechNet Single Item Recovery

http://technet.microsoft.com/en-us/library/ff660637.aspx

Mailbox Restore Exchange 2010

http://exchangeserverpro.com/restore-individual-mailbox-exchange-2010#mailbox

Excellent Post from ‘Chris and Robins Technology Blog’ Exchange 2010 Recovery

http://blog.chrislehr.com/2009/10/exchange-2010-recovery-scenario-1.htm

Great Resource for ESEUTIL

http://msexchangeguru.com/2009/07/12/exchange-database-recovery-using-eseutil-commands/

About Robert Pearman
Robert Pearman is a UK based Small Business Server enthusiast. He has been working within the SMB IT Industry for what feels like forever. Robert likes Piña colada and taking walks in the rain, on occasion he also enjoys writing about Small Business Technology like Windows Server Essentials or more recently writing PowerShell Scripts. If you're in trouble, and you can find him, maybe you can ask him a question.

10 Responses to SBS 2011 Standard : Exchange 2010 Single Message Restore

  1. John Dooley says:

    Great step by step guide – I will be bookmarking and stalking you on Twitter ! Kidding on the last part.

    I’ve managed 2003 servers for now over 7 years and installed Home Server and SBS 2011 Std for a friend. I’ve noticed one striking thing with the SBS 2011 backups you describe here, which related to Dell servers. If you ever wanted to do a Bare Metal Restore using the Dell OEM DVD disc 1 sbs 2011 Setup Disk, you will not see the option on the Install Now screen (after selecting languages) the Repair this computer option.

    So my lesson here is stick to other means of backups of servers from a commission stand point, such as ImageX and PE or 3rd party if your OEM Setup disc is like that of the Dell T110 power edge server. I know this recently because of a 3rd party IIS install of CRM software went wrong and it killed PowerShell and you name it went down with it, imagine the scene where the server is burning – people crying, dogs howling etc etc

    I’ve since rebuilt it and taken an image with a 3rd party package running under a different OS.

  2. Excellent article! One of those posts you want to tuck in your back pocket and save.
    Thanks.

  3. Daniel Croft says:

    Well done sir, your post will be bookmarked by every tech in our company. I’ve been having problems with our paid-for backup solution and have been considering using the built-in as a fallback, but was unsure on the procedure. You have saved me much research.

  4. Thank you very much. I was looking for a duidance like this for quite some time. But now I’ve finally arrived :-)

    Good Job.

  5. George says:

    A good explanation of what the Exchange group has made into quite a silly process, which seems to become worse with each release. It certainly does provide a lot of business for third parties however.

    I presume that one still cannot recover from databases created on other servers, but it would be good to know for sure. Another reason I just use OnTrack’s stuff, even with its problems.

  6. John says:

    Thank you for your excellent article. I do have one question – it seems that the restore procedure automatically restores the specified data from the recovery database to the production database – is this correct?

    Thanks again!

    • If i understand your question correctly, yes.

      There may be other methods available, but in this instance i wanted to just restore that message into the production database.

      You can choose to restore data from the RSG to an alternate mailbox if you prefer.

  7. bekirdurmaz says:

    When we restore an entire mailbox, do we get to restore the hidden folder which contains all recoverable deleted items as well?

Leave a reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 420 other followers

%d bloggers like this: