Lost and found: Use an Exchange recovery database to restore data

Execute the email recovery process

Recovery databases are special mailbox stores that are accessible only to administrators; they exist solely to obtain deleted email or other items from a production Exchange mailbox.

The email message restoration process involves a few steps. The administrator creates a new database object on the Exchange deployment and identifies it as a recovery database. The admin then restores a production database into the recovery database, which copies the data from a backup into the new recovery space. After that, Exchange reads from the mounted database. Finally, the admin runs mailbox recovery requests to bring data from the mounted recovery database into the corresponding mailbox or mailboxes -- or different mailboxes or archives -- to the production side.

Build the Exchange recovery database

Create the new database to hold the content we want to retrieve with the PowerShell command below. The –Recovery flag instructs Exchange that this database should not be treated as a typical mailbox database.

New-MailboxDatabase -Server EXCHANGE2016 -Name MyRecoveryDatabase -Recovery -EdbFilePath c:\exchange.edb -LogFolderPath c:\logs

Next, restore the production Exchange database with software or the other backup processes. For example, administrators who use Windows Server Backup would pick the location of the backup files and the date of the backup, and then choose Files and Folders to locate the database file (EDB) and the log files associated with the database. The administrator would then restore files to the locations used in the PowerShell command above to create the Exchange recovery database.

Next, use the ESEUtil utility to put the database in a readable condition. Find the location of the recovery database, and run the following at the command prompt:

eseutil /r log_file_base_name /l c:\path_to_log_files /d c:\path_to_database

Run the command below from the database directory to make sure the State field says Clean Shutdown, which indicates a successful recovery.

eseutil /mh databasename.edb

Next, use the name of the database to mount it with this command:

Mount-Database MyRecoveryDatabase

Once the database mounts, choose from one of the following restore options:

• Restore content from a mailbox on the recovery database to an identical mailbox on the production database;
• Restore content from the recovery database to an archive database;
• Restore content from one mailbox on the recovery side to a different mailbox on the production side; or
• Restore specific folders from within a mailbox into a corresponding mailbox, a different mailbox or a target archive mailbox.

Here are some sample commands that illustrate the required PowerShell syntax:

New-MailboxRestoreRequest -Name "Tim Jones Restore" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Tim Jones" -TargetMailbox "Tim Jones"

New-MailboxRestoreRequest -Name "Tim Jones Restore" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Tim Jones" -TargetMailbox "Tim Jones" –TargetRootFolder "Your Restored Items"

New-MailboxRestoreRequest -Name "Susan Smith Restore" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Susan Smith" -TargetMailbox "Susan Smith" –TargetIsArchive  –TargetRootFolder "Restored Items In Your Archive"

New-MailboxRestoreRequest -Name "Susan Smith to New Info Mailbox" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Susan Smith" -TargetMailbox "General Info" -TargetRootFolder "Susan Smith Items" -AllowLegacyDNMismatch

New-MailboxRestoreRequest -Name "Tim Jones Recovery of Acme Matter Content" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Tim Jones" -TargetMailbox "Tim Jones" -IncludeFolders "Acme Litigation/*"

To restore content from the built-in folders, surround the folder names with hashtags -- for example, #Inbox# or #Deleted Items#.

How to handle a conflict

When restoring a previous version of an item, the same name of the item already exists in the destination mailbox. The administrator needs to dictate which action to take and what data to keep -- the item from the recovery mailbox, the item with the latest date or everything and allow duplicates. Use the –ConflictResolutionOption PowerShell parameter to set these options:

New-MailboxRestoreRequest -Name "Tim Jones Restore" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Tim Jones" -TargetMailbox "Tim Jones" –ConflictResolutionOption KeepSourceItem

New-MailboxRestoreRequest -Name "Susan Smith Restore" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Susan Smith" -TargetMailbox "Susan Smith" –TargetIsArchive  –ConflictResolutionOption KeepLatestItem

New-MailboxRestoreRequest -Name "Susan Smith to New Info Mailbox" -SourceDatabase MyRecoveryDatabase -SourceStoreMailbox "Susan Smith" -TargetMailbox "General Info" -TargetRootFolder "Susan Smith Items" –AllowLegacyDNMismatch –ConflictResolutionOption KeepAll

After the restoration process, remove the mailbox restore requests. Completed requests remain in a queue for auditing purposes, so remove them to prevent current requests from mixing with completed ones. The first line displays the current requests to ensure the administrator selects the correct ones, while the second line removes them.

Get-MailboxRestoreRequest

Get-MailboxRestoreRequest | Where Status -eq Completed | Remove-MailboxRestoreRequest

The final step is to delete the Exchange recovery database to free up the disk space using these commands:

Dismount-Database MyRecoveryDatabase

Remove-MailboxDatabase MyRecoveryDatabase