In real time scenarios we will come across several issues where users will be requesting for an restore from the backup.

Restore can be in 2 scenarios

1) User might request for a recent data within 2 weeks of time.

2) User might request for a very old data a months back.

From Exchange 2010 we had the concept of LAG copy from which we will be able to perform restore of mailboxes according to the replay lag time set.

We can alter this value from 0 to 14 days . The LAG copies are not full backup solution but they can help us during DR scenarios as well as restoring mailbox contents for user only for shorter period of date i.e, within 14 days maximum.

We can perform a restore from a lag copy in exchange 2010/2013 and below are the steps

1)  Find the user requirement for restore. (Folder level restore or Mails missing restore)

2)   If its mails missing restore try to recover them by using MFCMAPI by following the below technet article

http://support.microsoft.com/kb/2750293

3) If it’s a folder level restore then we need to go ahead with our standard restore procedure since the folder can’t be recovered by using mfcmapi.

4) First we need to check the user is in which database by running the below command

Get-mailbox   <username> | fl database

5) After finding the database of that user find the lag copy of that associated database

get-mailboxdatabase  <DBname> -status | fl mountedonserver,replaylagtimes

6) Suspend the lag copy server and start copying the logs and database folder into separate folders. Resume the replication once copied.

7)      Take copy of the original database copied from the lag server in a separate folder.

8)    Check the database state by running the below command.

Navigate to drive where DB located:eseutil /mh “DB Location”

09) Copy the required logs till date for which the user requested for restore  to a different location in log sequence. Run the below cmd for checking any damaged log files.

eseutil /ml eXX

a) Navigate to the location where you have copied the required logs which we saw on the previous step while running eseutil /MH. Copy the  required logs in log sequence and then run the command.(usually soft recovery gets completed  with /a if it initially fails with required logs)

b) While running eseutil /ml e00 we need to specify the number accordingly to the sequence of the log generated. EX  in our case the log sequence starts with E06 so we  have mentioned eseutil / e06.If the log sequence is going to be E03 then we need to mention eseutil / E03

c) All the required logs should show ok.Else the restore will not be successful.

10) Perform soft recovery to bring the database to the clean shutdown by running the below command.

eseutil /r /a exx  /d “DB location” /l “log file location”

Modify the location accordingly and run the above command and you will get the below output

11)You will get the below output once the soft recovery is complete

12) Now when you check the database health it should show in clean shutdown as below

13)      Create a new recovery database with the below command

New-MailboxDatabase -Name RECOVERYDB  -Recovery -LogFolderPath “path location” -EdbFilePath ” path location” -Server  Recovery server name

Note:  If the below steps are not followed you will get error and the DB will not mount.

Do not mount the RDB which you have created.We need to rename the database which we repaired according to the RDB name .In our case we need to rename the EDB file as RECOVERYDB.edb

14) Check if the mailbox is present in Recovery database by running the below command. We are taking it as an output for our reference.

 [PS] C:>Get-MailboxDatabase RECOVERYDB| Get-MailboxStatistics   > D:output.txt

15)  Export to data to test mailbox folder or restore mailbox account from which we can extract the user data later.

 [PS] C:>New-MailboxRestoreRequest -SourceDatabase RECOVERYDB -SourceStoreMailbox “john”  -TargetMailbox recoverymbx -TargetRootFolder “testrecover”–AllowLegacyDNMismatch

16) Run the below command to check the mailbox restore status.

[PS] C:>Get-MailboxRestoreRequest   -Status Queued

Wait for 10 minutes and run the below command and the restore will be completed.

Get-MailboxRestoreRequest   -Status Completed

After restore gets completed extract the PST from the restored mailbox and hand it over to the user.

Thanks

Sathish Veerapandian