SBS 2011 Standard : Exchange 2010 Single Message Restore

During a recent SMB MVP Community Roadshow event in Edinburgh, a member of the audience asked us about Email restore in SBS 2011.

Although i knew this could be done, i had never actually done it. So i decided to work out how it was done with SBS 2011.

I found a lot of great resources online that helped me with the process and i have linked to them at the end of this post.

I’m focusing on a situation where we are restoring from a backup, rather than what is available through the Exchange dumpster (aka Recover Deleted Items) although i do cover that briefly below.

So this is the email i decided to accidentally delete and then try to restore.

As you can see this is a really important email i got from John Lennon, so i don’t want to delete it.

If i accidentally deleted it, and it was not in my Deleted Items, what can i do?

I can use Recover Deleted Items, which we can access through OWA.

Right Click Deleted Items, and notice the bottom option is to Recover Deleted Items..

This will open up a new window where you can browse the contents of your Dumpster and recover anything you didn’t mean to delete.

Make sure to select the email you want to recover, then hit the email icon with the blue arrow.

You can then choose which folder to recover the email into, and click the Recover button at the bottom.

You may find that the required email is not available in ‘Recover Deleted Items’ this can occur after the deleted items retention period has expired, or if someone accidentally clicks the delete button, not the recover button as described above.

This is the scenario in which you would want to restore your Exchange from backup.

(so for the purposes of this post you will have to assume i have accidentally deleted this email and that it is not available through recover deleted items.)

Recover Your Database

First of all we need to restore our Exchange database, of course that requires that we actually have a backup.

Luckily the built in SBS 2011 Backup can help us here, Loading up the SBS Console, and switching to the Backup and Server Storage tab, we can click on “Restore Server Data from Backup”

The Windows Server Backup application will load up, in the top right you can choose to ‘recover..’

The Recovery Wizard will launch and you have the choice of whether to choose a backup stored on the local computer, or on another location. The default for SBS will be a backup stored on this server. Click Next

Next choose the date that you want to restore from, and click next.

Because SBS 2011 backup links into Exchanges’ VSS Writers, we can chose to restore Exchange as Application, rather than restoring the data files individually.

Select Application and click next.

You then have the choice of whether to restore Exchange or SharePoint. Seeing as this a post about Exchange, it is safe to assume you want to select Exchange.

(you also have the choice of whether or not to roll the database forward, if you selected the most recent backup. In 2003 days a Roll Forward backup was explained as: "Roll forward" restoration. The log files that were created after the backup are played into the database. If all of the log files are available, all of the data that was created after the backup can be preserved. If circular logging is enabled, you must perform a "point in time" restoration of your offline backup; you cannot choose a "roll forward" restoration)

As we are restoring along side the production database and not doing a full BMR (Bare Metal Restore) of the entire Exchange server, tick the box to prevent the roll forward, and click next.

The next step is quite important, well i say quite important, i mean Exceptionally Important.

Very, very, very important.

Please choose to ‘recover to an another location’ then click Browse, to find a folder on the Server to restore the Exchange to. I have put a ‘Recovery’ Folder on my desktop to make it easy to find the recovered folders.

Clicking Next will show you a summary page showing which Information Store items will be restored, and to which location.

Clicking Recover, starts the recovery process.

Remember at this point we are recovering the Entire Exchange Database so make sure you have adequate disk space.

Check Shutdown State Of Database

Depending on the size of your Database the restore may take quite some time to complete. Once it has completed, browse to the folder that contains your restored Database EDB file. You will notice that the restore procedure has restored into an identical folder tree structure.

Hold Down Shift, and Right click some free space, and choose Open Command Window Here.

We are going to use Eseutil to check the shutdown state of the database. It is likely the database is in a dirty shutdown state and that we will need to run recovery to bring it to a clean shutdown state.

Enter the following command in the command prompt.

ESEUTIL /MH “Mailbox Database.edb”

In the resulting readout, scroll up to see the Database Shutdown State line. If the state shows as Dirty Shutdown we will need to run a recovery command, if it shows as Clean Shutdown you can skip this step.

We can also check the status of the Transaction Logs using another switch to the Eseutil command.

ESEUTIL /ML <path to logs folder and log prefix>

ESEUTIL /ML “c:\users\dfunk\desktop\recovery\c_\program files\Microsoft\exchange\v14\mailbox\mailbox database\E00”

Perform Soft Recovery of Database

To run recovery we need to run the following command.

ESEUTIL /R E00 /D <path to database folder>

In my example the database files were restored to c:\users\dfunk\desktop\recovery\c_\program files\Microsoft\exchange\v14\mailbox\mailbox database\

So my recovery command would be:

ESEUTIL /R E00 /D “c:\users\dfunk\desktop\recovery\c_\program files\Microsoft\exchange\v14\mailbox\mailbox database”

Your database should be recovered to a clean shutdown state, and you can run the previous Eseutil command (/MH) to check for the state.

Once you have the database in a clean shutdown state, we need to create a Recovery Database (RDB).

Create a Recovery Database

In Exchange 2003/7 we would create a Recovery Storage Group which we could do through the Exchange Management Console. In Exchange 2010 we must use the Exchange Shell to create a Recovery Database.

Load up the Exchange Shell and enter the following command.

New-MailboxDatabase –Recovery –Name RDB1 –Server SBSSERVER

(you can specify the location for the database and log files with other switches, but the above command will create the RDB with the default locations for Logs and Database)

Once the database has been created we need to set the allow file restores flag to true.

Set-MailboxDatabase –AllowFileRestore:$True –Identity RDB1

Now we need to move our restored database to the folder our RDB database is looking at and rename the database file “Mailbox Database.edb” to “RDB1.edb”.

Go to the location of your restored Exchange database, and find the EDB file. Copy this file, and only this file, to the location of your RDB. (the default will be C:\Program Files\Microsoft\Exchange ServerV14\Mailbox\RDB1)

Mount the Recovery Database

We can now mount the database using the following command:

Mount-Database RDB1

To check the database has been mounted successfully (assuming you didn’t get an error in the Shell) you can Load the EMC and navigate to Organization Configuration, Mailbox, you should see in the mounted column if the database is mounted or not.

We can then run this command to read the database and tell us which mailboxes are present, you probably wouldn’t need to do this in most cases, as you will only have one database but in environments with multiple databases it might be useful to verify you have actually got the right database mounted.

Get-MailboxStatistics –database RDB1

Finally we can actually recover some email.

Recover Deleted Items

In my Example i have deleted an email from a user called John Lennon which i would like to recover. As i showed at the start of the post, it was a really important email. It also contained the word ‘important’, so i can use the ‘AllContentKeywords’ switch to help find it.

Restore-Mailbox -Identity dfunk –RecoveryDatabase rdb1 –allcontentkeywords "important"

Restore-Mailbox is the CMDLET to use, Identity selects which mailbox to recover, RecoveryDatabase selects which database to recover from, and AllContentKeyWords allows me to select a keyword that was present in either the subject or the body.

The read out from the Exchange Shell should show you if this was a success or not, but as you can see from OWA, the message is restored almost instantly for me.

Using a keyword like this can be useful especially if a user is not 100% sure on what the email contained or who sent it, but it may have the unhappy side effect that it restores not only the desired email, but every email that contains that keyword. Luckily there are some other options we can use with our restore command, i am not going to cover them all but i will cover the Target Folder option, I’m also changing from using AllContentKeywords to SenderKeywords

Specifying a target folder, tells the restore process to put the restored items into a folder you name. This allows us to account for a potential large number of email being restored without causing too much further disruption to the user.

The syntax of our command would change slightly to include a different switch, –TargetFolder

Restore-Mailbox -Identity dfunk –RecoveryDatabase rdb1 –TargetFolder “inbox\_recovery” –senderkeywords "John Lennon"

You are then prompted to enter the display name of the source mailbox

Switching back to OWA we can now see our Target Folder command has built a folder sub tree, and in two folders we have unread items, which are our restored emails.

There are a lot of variables in situations where you will want to restore email, variables in the information you have to work with, and also on how specific you want to be when issuing your recovery commands. The links below show how you can use dates to target the restore as well as using the keywords i have shown in my examples.

Hopefully this has been useful.

 

Related Links

You can refer to the links below for more detailed syntax for the Restore-Mailbox command and for more info on the restore process.

Restore-Mailbox

http://technet.microsoft.com/en-us/library/bb125218.aspx

Explaining Single Item Recovery In Exchange 2010

http://blogs.technet.com/b/exchange/archive/2009/09/25/3408389.aspx

Explaining Single Item Recovery In Exchange 2010 Continued

http://blogs.technet.com/b/exchange/archive/2010/04/26/item-recovery-in-exchange-2010.aspx

TechNet Single Item Recovery

http://technet.microsoft.com/en-us/library/ff660637.aspx

Mailbox Restore Exchange 2010

http://exchangeserverpro.com/restore-individual-mailbox-exchange-2010#mailbox

Excellent Post from ‘Chris and Robins Technology Blog’ Exchange 2010 Recovery

http://blog.chrislehr.com/2009/10/exchange-2010-recovery-scenario-1.htm

Great Resource for ESEUTIL

http://msexchangeguru.com/2009/07/12/exchange-database-recovery-using-eseutil-commands/