exchange restore

[GeoDM]

A user noticed that they were missing several folders in their outlook several months ago but just now mentioned it. Thus I will have to restore these from the tape. I performed the Information Store, restore and ran into the problem everyone is always talking about, about the service not restarting. So I followed the instructions from MS Tech Net and got the backup from last Friday (today is tue) and exchange 5.5 is working fine. Part of those instructions was to remove he log files so I made a copy. Since this morning several log files have been created but I need to get data back to exchange from the old log file IE the messages from Sat, Sun, and Mon (since no one backed up Monday). Is this possible? Can someone please point me in the right direction to recovering these last 3 days of mail. Thanks in advance

 

[zbnet]

Did you use

http://www.microsoft.com/Exchange/techinfo/administration/55/backuprestore.asp

? This will help you with restores, it's required reading before doing anything with Exchange regarding logfiles and tapes.

 

[GeoDM]

Yea I did get this document after the fact. What happened is I took direction from a person here, who claimed to have done this before and now its apparent they have not after the problems I have run into.

 

[zbnet]

Have you actually lost all the email from Sat, Sun and Mon, or just the log files? If you already have the email in the store, then you don't really need these logfiles (I'm assuming you have circular logging turned off?).

Just make sure you take a good online backup of the store as of now, and you'll be okay (because you can come back to this backup is necessary).

Did you get the deleted folders back (the original problem)? If not, you need a serperate restore server, as explained in the document you've got.

 

[GeoDM]

Yes I have gone throught that document and have unfortunatly learned the hard way. But what I do have is the log files from Sat, Sun, and Monday but no backup since it was not performed in my absense Monday. Last night was our first backup since Friday. So can I use these log files to restore the missing mail?

 

[zbnet]

But is the mail really lost? Logs are committed to the database in the background, or when you shut the service down; so this mail is probably already in the Database, unless you restored and old backup over the top of your production database??

 

[GeoDM]

To my knowledge the mail should not be lost. When I applied the backup I performed a no lost restore so they should be there correct?

By the way thanks for the help you are providing. I am feeling confident something can be done.

 

[zbnet]

A no loss restore simply means do not delete any existing logs. It is typically used when you have a corrupt database, and still have the logs from when the last good database backup was taken. It means you can put an old copy of the database back (without deleteing the logs on disk), and then when you start the IS service again the logs are replayed against the database, thus bringing it up to date again.

If you had a good database (not corrupt), and you restored an old backup, then restarted the IS service again BUT WITHOUT THE LOGS PRESENT, the no loss restore switch made no different, and you've effectively rolled your database back to last Friday. Also, because it's started again, it is now using new transaction logs.

Transaction logs need to be in sequence, so I think you're going to find that your logs between Friday and Monday are now not going to fit into the ssequence...? Check out the file numbers, they use simple Hex progression in the naming sequence. You can't have any missing sequences, or Exchange will just stop reading the log files.

If your Fri-Mon log files are a contiguous sequence with your exsisting log files, you might just be able to stop the IS, put all the logs back together, delete the checkpoint file, and get them to all replay against the database, but I'd say this is looking increasingly unlikely. You may have to accept data loss.