4

We recently had an outage on our DC - one disk out of a 4 disk raid array failed and it ran in degraded mode for about 3 weeks before we were able to replace the disk. By the last day before it got replaced, exchange was running so poorly that for some users it would fall over as soon as they opened their mailbox (I assumed they had corrupt mailboxes). We replaced the disk and the rebuild was a success, but when the exchange DB was still corrupt, and got restored from backups a week only - blowing away a small subset of emails.

All that was completed by another staffmember, but here is where I step in - about a month later and some staff are discovering that an email that was lost is super important. When they restored from the backup they put a copy of the exchange database they restored to in a new iSCSI drive along with the logs from between the backup being taken and the server being restored. From what I have been told, this should be enough to get us a working view of the mailstore on that day so that I can get the 5 or 10 really important messages out of there.

Problem is I know nothing about exchange. Google suggested http://technet.microsoft.com/en-us/library/bb124040(v=exchg.65).aspx and similar pages but these seem to be to do with repairing the running database, which is not what I want - right now email is working, I don't want to change that.

We use SBS 2008 and Exchange 2007 - any suggestions on where to start would be greatly appreciated.

Improve this question
4
  • 2
    RAID 5? Three weeks?
    – ewwhite
    Feb 28, 2013 at 4:46
  • RAID 5 is correct, sorry, should have included that. And yeah, I know, keeping a production disk in degraded mode that long is ridiculous - it was an unavoidable timing and budget thing.
    – Chris O'Kelly
    Feb 28, 2013 at 21:38
  • Have you checked iff are there any copies of those emails in client machines?
    – beto
    Mar 7, 2013 at 23:50
  • I want to reply "No, unfortunately we don't use cached exchange mode", but I'd be glad to be told that is absolutely wrong and the messages may be stored on the machines anyway
    – Chris O'Kelly
    Mar 8, 2013 at 5:06

3 Answers 3

Reset to default
4

At this point in time, if the emails are "super important" then I'd strongly suggest getting someone who does know exchange fully involved. I don't want to sound disrespectful, but this is not the best point to start learning from.

If you can't do that (though I really do think you should try - this situation sounds like it would benefit from an on-site look-over from an experienced exchange consultant), I'd suggest using out of band recovery tools - something that allows you to mount and inspect the information store outside of exchange. I use ontrack powercontrols when I help people to do this DR route, but there are other options out there.

How did you/whoever establish that exchange had a corrupted datastore anyway? That shouldn't happen because of one disk in a RAID array dropping out - either there was no fault (or at least no corrupt database issue) with the Exchange server or you still have an issue with this system that you need to discover and nail down before it goes wrong again.

Improve this answer
2
  • Yeah, I dream of being able to get other talent onsite, but its just not in the budget. And I agree, this is not where I would have chosen to start with Exchange either. In terms of how it was determined to be corrupt - apparently when the bad disk was replaced and the array rebuilt, the information store would not start up. That's all I know unfortunately, apart from that to get it running again they restored week old backups.
    – Chris O'Kelly
    Mar 4, 2013 at 3:21
  • 1
    I sympathise on the budget thing - you need to make it clear to people that if they want to keep important emails in exchange (or any other system for that matter) then they need to make the budget match the importance
    – Rob Moir
    Mar 4, 2013 at 6:23
3
+50

You can mount a recovered database using a Recovery Storage Group; this will not overwrite your production database, will perform full transaction logs replay (which will bring the database back to the point in time before the crash) and will let you extract messages from it and merge them into their mailboxes.

The process is relatively simple for someone who knows Exchange well; there are of course various tutorials around, but I agree with RobM: try to get someone involved who knows what he's doing.

Improve this answer
0

Look into exmerge. When I needed to locate a certain email that we suspected had a virus I found this tool. Never got a chance to use it but from every thing I read it is very powerful and could probably do what you need.

http://www.microsoft.com/en-us/download/details.aspx?id=2743

Improve this answer
2
  • 2
    I've looked at exMerge before as a solution to a different problem. Correct me if I am wrong, but isn't it only functional on an up and running Exchange database?
    – Chris O'Kelly
    Mar 8, 2013 at 5:07
  • Looking at more pages on it, it looks like you're right.
    – Ericrobert
    Mar 8, 2013 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .