This article providers step by step instruction on how to restore individual mail items back to user mailbox in Exchange 2013
Scenario: user deleted folder in his mailbox
Let's use for our example following scenario:
User Billy has accidentally deleted his IMPORTANT folder, and by the time he discovered that folder is missing, item has been already purged from Recoverable Items storage container. Here is screenshot of his original folder
In this scenario, we deleted "IMPORTANT" folder and purged "Deleted Items"
Steps to recover
1. Determine which database hosts user mailbox
We need to find out which mailbox database hosts Billy's mailbox. If your environment uses a single mailbox for all users, skip this step.
Exchange Management Shell (Poweshell)
2. Create "Recovery Database" using Exchange Management Shell (Powershell)
In this step, we need to create recovery database, which serves a purpose of temporary storage for our restored mailbox.
Make sure, that disk where you create recovery database, has enough free space to accommodate entire mailbox database. If you production database is 500Gb, you need same amount of space to restore a copy mailbox copy to recovery database
- Create folders where recovery database will reside, in our case these are "C:\EXCH-DATA\RDB1-DB\" and "C:\EXCH-DATA\RDB1-LOG"
Run the New-MailboxDatabase cmdlet with the following parameters:
- -EdbFilePath (the path to the restored mailbox database file)
- -LogFolderPath (the path to be used for transaction log files, which must be an empty folder)
- -Server (the server that the recovery is being performed on)
3. Use ZCB/ESB to restore mailbox to Recovery Database
Lunch ZCB/ESB, select backup run containing your mailbox database, set appropriate options on Restore Tab.
4. Mount Recovery Database
Exchange Management Console
5. Restoring Mailbox Items from a Recovery Database
Now, when recovery database is mounted we can now proceed with mailbox item restores. You can use Get-MailboxStatistics see the available mailboxes to restore
Restore Items into sub-folder of user Mailbox
We will use Restore-Mailbox cmdlet to restore entire folder Inbox into Restore folder. If you want perform more granular restore, like specifying subject of the message for example, see more detailed information about Restore-Mailbox cmdlet - Exchange 2010
6. Verify and move restored items to appropriate location
Use Outlook to view or move restored items to their Original Location. As you can see from the picture below, now we can move "IMPORTANT" folder back to its original location under Inbox.
7. Alternative restore destination - Outlook PST file
In some scenarios, you might want to get restored items in the form of PST file, rather then recover them directly to user mailbox. For example you need to retract emails of the employee who is not longer with organization. In such case, you would want to create temporary user with exchange mailbox, recover email items to it, and then extract recovered content to PST file. Below is an example of how it can be achieved
A. Create temporary new User Mailbox for temp New User
In our example, we call new user "Billy Recovery", with user name billyrec. You can choose any mailbox database (in case you have multiple)
B. Use procedures described in Steps 1 - 4 to have recovery database mounted
C. Recover mailbox items with Restore-Mailbox cmdlet
In this example we use Restore-Mailbox cmdlet to restore entire folder Inbox into Restore folder of our temporary user "Billy Recovery". For more detail about performing more granular restore follow this link: Restore-Mailbox cmdlet - Exchange 2010
D. Extract the contents of the recovery mailbox to a PST folder
Create a network share where you planning to place extracted PST file. Make sure that "Exchange Trusted Subsystem" group has full permissions on the share.
You might need to assign Mailbox Import Export role to Exchange administrator's account, unless it is done already. See more info here: Error message when you run the New-MailboxExportRequest cmdlet in Exchange Server 2010 SP1 or Exchange Server 2010 SP2: "Couldn't find the Enterprise Organization container" . Therefore we run command below and log on/off to exchange server for the new role assignment to get applied to exchange administrator account.
In this example, user is specified using domain name convention, where domain name is WQA1.local
Run New-MailboxExportRequest cmdlet. More information about this cmdlet can be found here http://technet.microsoft.com/en-us/library/ff607299(v=exchg.141).aspx
If mailbox is large, export process can take some time. Hence, you can check the progress of export task by piping to 2 cmdlets: Get-MailboxExportRequest and the Get-MailboxExportRequestStatistics
E. Verify recovered content.
Once you get PST file, you can open it in Outlook to verify recovered content
8. Perform cleanup operations
- dismount recovery database and delete files from database folders
- if you used temporary user for recovery, delete its mailbox and account in AD and associated files, like PST.