Exchange – One option to restore data from lagged database copy

Recover data from lagged copy:

1. Gather info where user resides

Usually we need to know in which database user resides

2. Check if mailbox is still in disconnected mailboxes

Get-MailboxDatabase mdb13 | get-mailboxstatistics | where {$_.disconnectdate -ne $null}

DisplayName               ItemCount    StorageLimitStatus                                                 LastLogonTime
-----------               ---------    ------------------                                                 -------------
a1			  1962                 BelowLimit                                           5/7/2013 4:01:41 PM
S 		          2075                 BelowLimit                                          6/19/2013 9:26:52 AM
Hän		          185                  BelowLimit                                          4/30/2013 9:19:26 AM

3. Mailbox is not in disconnected state

If mailbox is not in disconnected mailboxes anymore, we have another 14 days before lagged copy disconnected date expires

4. Suspend lagged copy

Suspend lagged copy by command:

Get-MailboxDatabase mdb13 | Get-MailboxDatabaseCopyStatus

Name                                          Status          CopyQueue ReplayQueue LastInspectedLogTime   ContentIndex
                                                              Length    Length                             State
----                                          ------          --------- ----------- --------------------   ------------
MDB13\SRVMBX1                          		Mounted         0         0                                  Healthy
MDB13\SRVMBX2                          		Healthy         0         2           7/9/2013 11:33:38 AM   Healthy
MDB13\SRVMBX3                         		Healthy         0         2           7/9/2013 11:33:38 AM   Healthy
MDB13\SRVPF1                           		Healthy         0         110355      7/9/2013 11:33:38 AM   Healthy

Suspend-MailboxDatabaseCopy MDB13\SRVPF1

Confirm
Are you sure you want to perform this action?
Suspending mailbox database copy "MDB13" on server "SRVPF1".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [?] Help (default is "Y"): y

5. Copy lagged database to different location

To perform non destructive recovery we need to create additional copy of lagged database. This database will be restored to particular point in time.

6. Check if database is in clean shutdown

Dump headers of database by command:

eseutil /mh .\MDB13.edb

Extensible Storage Engine Utilities for Microsoft(R) Exchange Server
Version 14.03
Copyright (C) Microsoft Corporation. All Rights Reserved.

Initiating FILE DUMP mode...
         Database: .\MDB13.edb

DATABASE HEADER:
Checksum Information:
Expected Checksum: 0xf3fb4807
  Actual Checksum: 0xf3fb4807

Fields:
        File Type: Database
         Checksum: 0xf3fb4807
   Format ulMagic: 0x89abcdef
   Engine ulMagic: 0x89abcdef
 Format ulVersion: 0x620,17
 Engine ulVersion: 0x620,17
Created ulVersion: 0x620,17
     DB Signature: Create time:01/24/2012 02:52:12 Rand:391137630 Computer:
         cbDbPage: 32768
           dbtime: 3824249608 (0xe3f16b08)
            State: Dirty Shutdown

7. Determine PIT backup time and move newer logs elsewhere

In my example I want DB to be recovered to 29.6.2013. Be careful! You need EDB file 🙂

PIT

8. Reply logs to database to specified point in time:

Newer logs than specified PIT should be moved elsewhere or deleted (better after recovery process has been done)
Chk file should be removed (checkpoint) to reply all logs present in directory.
The following command will reply logs till PIT to database

Eseutil /r eXX /a

Replay_logs_progress

9. Put DB to clean shutdown

If the database is still in Dirty shutdown mode, we need to run integrity check and hard repair the database

eseutil /p .\MDB13.edb /g

DB repaired

10. Check if DB is in clean shutdown after repair

eseutil /mh .\MDB13.edb

Clean Shutdown

11. Delete all log files since those are not needed anymore

12. Create recovery database

New-MailboxDatabase -Recovery -Name RDB_13 -Server SRVPF1 -EdbFilePath e:\lagged_mdb13\mdb13
.edb -LogFolderPath e:\lagged_mdb13
WARNING: Recovery database 'RDB_13' was created using existing file e:\lagged_mdb13\mdb13.edb. The database must be
brought into a clean shutdown state before it can be mounted.

Name                           Server          Recovery        ReplicationType
----                           ------          --------        ---------------
RDB_13                         SRVPF1   True            None

13. Mount database

Mount database by issuing command:

Mount-Database RDB_13

14. Gather data about mailbox, you want to restore

Display name or StoreMailbox guid. For example use this command:

get-mailboxdatabase rdb_13 | Get-MailboxStatistics | where {$_.Displayname -like "Niitty*"}

mailbox_to_recover

15. Restore mailbox

To restore mailbox use the following command:

New-MailboxRestoreRequest -SourceDatabase RDB_13 -SourceStoreMailbox "Surname, name" -TargetMailbox alias -AllowLegacyDNMismatch

16. Check results

Get-MailboxRestoreRequest "MailboxRestore"

status

Whitespace not increasing when moving mailboxes to other database

Let’s try to look at this topic: White-space not increasing when moving mailboxes to other database and also more.

What is reason for it?
When a mailbox is moved to another database, it´s only softdeleted (-MailboxState SoftDeleted). This mean that its kept in the origional database until the time you have set for the database to keep deleted mailboxes (Default 30 days) has past.

Is it related also for disconnected/disabled mailboxes?
Yes, it is. Disconnected mailboxes are also still in database for retention period (-MailboxState Disabled).

How to check white-space and database size for mailbox databases?

Get-MailboxDatabase -Status| ft name,AvailableNewMailboxSpace,DatabaseSize -a

Get-ExchangeDatabaseInfo

How to find softdeleted and disabled mailboxes for particular database?

Get-MailboxStatistics -Database MBD01 | Where { $_.DisconnectReason -eq "SoftDeleted" -or $_.DisconnectReason -eq "Disabled" } | Format-List LegacyDN, DisplayName, MailboxGUID, DisconnectReason

How to purge softdeleted mailboxes and consequently increase white-space (AvailableNewMailboxSpace)?

Remove-StoreMailbox -Database MBD01 -Identity Ayla -MailboxState SoftDeleted

This example permanently purges all soft-deleted mailboxes from mailbox database MBD01.

Get-MailboxStatistics -Database MBD01 | where {$_.DisconnectReason -eq "SoftDeleted"} | foreach {Remove-StoreMailbox -Database $_.database -Identity $_.mailboxguid -MailboxState SoftDeleted}

Remove-StoreMailbox

Is it possible to remove “active” mailbox by Remove-StoreMailbox?
No, the cmdlet accepts only SoftDeleted or Disabled mailboxes.

Is there delay for white-space incrteasing after using Remove-StoreMailbox?
Yes, there is the delay, but basically only few seconds.

Is it possible restore softdeleted or disabled mailboxes?
Yes of course via New-MailboxRestoreRequest.
Softdeleted mailboxes can be only exported to existing mailbox, but disabled mailboxs can be connected and also exported same like softdeleted.

New-MailboxRestoreRequest

Connect-Mailbox

How to Reconnect a Disconnected Mailbox in Exchange Server 2010