In Exchange 2010 Mailbox Server Backup and Restore Part1 we completed the backup procedure. We are now able to use this backup to perform the following recovery operations:

• Recover an email item
• Recover a user mailbox
• Recover a mailbox database
• Recover a server

In our recovery scenarios we will not make use of the deleted items retention and deleted mailbox retention configured at the mailbox database. Those recovery procedures don't use the backup we created earlier. Instead we will assume that the email item (or mailbox) has been deleted and the deleted items retention (or deleted mailbox retention) period also expired. In this case, the only place from where we can recover our email or mailbox is the backup.

Recovering an Email Item

Windows Server Backup does not have an option for single email item recovery, so we must first recover the complete database, and then extract the user mailbox from the database.

In order to demonstrate recovering an email item, let's have a look at the users Outlook Web App client, and delete one email item with subject "Very important information" as shown below:

We will first delete this item from the user's mailbox, delete it from the Deleted Items folder, and assume that the Deleted Items Retention period expired.

Let's start Windows Server Backup, and choose the Recover option.

Since our backup data was taken from this server, we choose This Server, and click Next.

Then, we choose the location type as Remote shared folder (picture not shown), and at the next step we specify the remote shared folder location.

On the page that follows we are asked to specify the backup date. Here we will choose our latest backup and go on to the next window.

On Select Recovery Type page, we select Applications.

Clicking Next, we can see how Windows Server Backup recognizes Exchange Server data, because it is an Exchange-aware application.

Furthermore, if we click on View Details, we see the GUID of the database we are recovering data from.

Next step is to choose the restore destination. We choose the folder named Exchange Restore on drive C.

Finally on the confirmation page, we choose Recover and wait for the recovery progress success notification.

So far we have restored the exchange database files to an alternate location. Next step is to extract the user's mailbox and retrieve the email item we want to restore.

In order to do that, we will introduce a special type of database called Recovery Database.

Recovery Database

A Recovery Database is created and used exclusively for the purpose of restoring user email items or mailboxes in a situation where the production mailbox databases are running and healthy. A Recovery Database is not counted when Exchange limits the number of databases allowed for Exchange Standard and Enterprise Editions. It also cannot be used as a database copy for Database Availability Group scenarios.

We will create the Recovery Database and associate it with the Managers database just recovered, using the following cmdlet at the Exchange Management Shell:

New-MailboxDatabase -Name "RecoveryDB" -Server MBX1
-EDBFilePath "c:\Exchange Restore\E_\Managers Database\Managers.edb"
-Logfolderpath "c:\Exchange Restore\F_\Managers Logs" -Recovery

After creating the Recovery Database, we can see this at the Exchange Management Console:

When using a Recovery Database, the restored mailbox database is in Dirty Shutdown state. This can be checked at the Exchange Management Shell using:

Eseutil -mh "c:\Exchange Restore\E_\Managers Database\Managers.edb"

This command will output multiple data. Here we should search for:

State: Dirty Shutdown

In order to bring the recovery database in clean shutdown state we use the following command:

eseutil /R E02 /d "c:\Exchange Restore\E_\Managers Database\Managers.edb"
/l "c:\Exchange Restore\F_\Managers Logs" /i

Here E02 is a three-character log file base name. All transaction log files that are associated with the Managers databases start with E02.

Again, we will check the shutdown state of the Recovery Database, using the same command:

Eseutil -mh "c:\Exchange Restore\E_\Managers Database\Managers.edb"

We should now look for:

State: Clean Shutdown

At the end, we will mount the Recovery Database from the Exchange Management Console or the Exchange Management Shell using:

Mount-Database -Identity RecoveryDB

Now once the Recovery Database is mounted, we restore the mailbox for Vladimir using:

Restore-Mailbox -Identity Vladimir -RecoveryDatabase RecoveryDB

We confirm that the email item has been restored by accessing our mailbox using Outlook Web App:

Another option is to restore the mailbox to a folder within our production mailbox, using the command:

Restore-Mailbox -Identity Vladimir -RecoveryDatabase RecoveryDB
-RecoveryMailbox "Vladimir Meloski" -TargetFolder RestoredItems

We confirm that the complete mailbox has been restored into a folder named "RestoredItems" using OWA:

Now it is safe to dismount and remove the RecoveryDB database using Exchange Management Console or Exchange Management Shell cmdlets:

Dismount-Database -Identity RecoveryDB
Remove-MailboxDatabase -Identity RecoveryDB

The physical database file and transaction log files of the RecoveryDB should be deleted manually.

Conclusion

In this article you learned how to restore deleted email items using the Windows Backup feature included in Windows Server 2008 and 2008 R2..

We will continue this article series and will learn how to restore a deleted mailbox, how to restore a mailbox database, how to use dial-tone recovery procedure and how to restore the mailbox server role using Windows Server Backup.