It can happen at any time: You get a request, as Admin,  from your company, to provide the contents of somebody's mailbox from a backup set as part of an investigation. The Recovery Storage Group is usually the easiest way to do this. It may either mean using the Exchange Management Console or the Exchange Management Shell. Jaap explains all.

Very recently I was at a customer and the Exchange administrators had received a request from the legal department to retrieve somebody’s mailbox from several backup sets and create .PST files of the inbox. The .PST files had to be handed over to the legal department. Of course the particular user was not aware of these actions.

The Exchange administrator retrieved the Exchange database files from backup (130 GB!) but had absolutely no idea how to retrieve the mailbox data out of the files. The Recovery Storage Group in Exchange Server 2003 and Exchange Server 2007 can be very useful in a situation like this.

Backup and Restore

This particular customer made a full backup of their Exchange Server 2003 database every weekend and every night an incremental backup was created. This means that during a normal night the Exchange Server database is not backed up, but the Exchange Server log files are backed up and purged from the disk. Please refer to my article “Online Exchange Backups” on Simple-Talk.com for more information on these backup techniques.

If data from a mailbox out of a backup that’s 14 days old needs to be retrieved you have to get that backup set, but you cannot just simply restore the database to its original location. In order to restore the database to its original location the database needs to be dismounted and the 14 days old backup has to be restored. This not only results in an outage but will also result in a loss of data if you’re not careful, so this is not an acceptable option. Also you have to restore the full backup made during the weekend, and possibly one or more incremental backups, depending on the date stamp you have to restore.

A Recovery Storage Group is like any other Storage Group, except for the fact that databases mounted in a Recovery Storage Group do not contain live mailboxes but only disconnected mailboxes. A Recovery Storage Group is a Storage Group that can be used for recovery purposes; you can restore a database from a backup set in a Recovery Storage Group and recover data from it. A Recovery Storage Group and the database(s) it contains are invisible to the end-users and Outlook clients, only the administrator can access the Recovery Storage Group and the database(s) it contains.

Suppose there is a user in our Exchange Server 2003 environment named Joe Sixpack. Joe is under suspicion of the legal department and the legal department has requested a copy of his mailbox to check whether Joe has sent out some confidential information to the Internet. Joe’s mailbox is located on an Exchange server named 2003SRVR in the default mailbox store in the First Storage Group. This Storage Group contains three databases in total. There’s also a second Storage Group that hosts only one Mailbox Store.

To retrieve a copy of Joe’s mailbox the IT department wants to use the Recovery Storage Group option in Exchange Server 2003.

Follow these steps to create a Recovery Storage Group in Exchange Server 2003:

1.  In Exchange System Manager, select and then right-click the Exchange Server 2003 object, select New and then select “Recovery Storage Group”;

2. Enter the location where the transaction log files and the checkpoint file should be located. By default it is in the “C:\Program Files\Exchsrvr\Recovery Storage Group” directory, but it can be any location you want. Please keep in mind that there should be sufficient storage available to host the complete database and all log files. If you want to perform recovery steps using ESEUTIL you have to take an additional storage requirement into account;

3. An empty directory is created where the database and the log files will be stored.

When the Recovery Storage Group is created the database that needs to be restored must be selected.

1. In the Exchange System Manager, right click the Recovery Storage Group and select “Add Database to Recover”;
2. All mailbox databases that are known in Active Directory are displayed, so Joe’s Mailbox Store should be selected, this is in this example “Mailbox Store (2003SRVR)”;
3. After clicking OK the Mailbox Store properties are shown, leave these at their default values and click OK;
4.   DO NOT MOUNT THE DATABASE

The database is now created in the Recovery Storage Group in Active Directory. The next step is to restore the database from the backup set.

No additional steps are needed here. When a Recovery Storage Group is created the behaviour of an online restore is changed. The database is not restored to its original location, but it is automatically redirected to the Recovery Storage Group location that’s created earlier. Just restore the “Mailbox Store (2003SRVR)”, it will be automatically placed in the right directory.

Figure  1. The Recovery Storage Group directory and its contents right after a restore operation

In a normal Storage Group in Exchange Server 2003 the log files have a prefix like E00, E01, E02 or E03. In a Recovery Storage Group the prefix is R00. This way it is always clear when a particular directory contains data from a Recovery Storage Group.

After the Exchange database is restored from a backup set it can be mounted. Just right click this database in the Recovery Storage Group in the Exchange System Manager and select “Mount Store”.

Remember that the database in a Recovery Storage Group is actually an old version of the running database, so it also contains all mailboxes that are in the running database. In the Recovery Storage Group however these are disconnected mailboxes, i.e. the original user accounts in Active Directory are matched to the mailboxes in the running database.

Figure:2. After mounting the database in the Recovery Storage Group contain disconnected mailboxes.

The last step is to create a .PST file from Joe Sixpack’s mailbox. The Exchange System Manager contains some functionality to copy or merge this data into the running mailbox of the user, for creating a .PST file the free Microsoft tool EXMERGE have to be used. Exmerge can be downloaded from the Microsoft website: http://www.microsoft.com/downloads/details.aspx?familyid=429163EC-DCDF-47DC-96DA-1C12D67327D5&displaylang=en. More information about the usage of Exmerge can be found in Microsoft knowledgebase article 327304: http://support.microsoft.com/?kbid=327304

To retrieve the contents of Joe Sixpack’s mailbox from the Recovery Storage Group follow these steps:

Figure:3. Select the database from the Recovery
Storage Group

1. Start the Exmerge.exe utility from the local disk;
2. In the Microsoft Exchange Mailbox Merge Wizard select “Extract or Import (Two Step Procedure)” and click Next;
3. Select “Step 1: Extract data from an Exchange Server Mailbox” and click Next;
4. In the Source Server window enter the servername and the domain controller name and click Next;
5. In the Database Selection Windows select the Mailbox Store in the Recovery Storage Group. This is the “old” store where Joe’s data need to be extracted from:
6. In the next windows select Joe Sixpack’s mailbox:
   

   Figure:4. Select Joe Sixpack's mailbox to retrieve
   the data from

7. In the Next Windows select the locale, the default setting is “English (US)”.  The last mailbox login locale can also be selected by clicking the Checkbox;
8. Select the Folder (directory) where the .PST file will be stored. Any directory can be used;
9. Save the settings (default selection) and watch the export process going on.
10. When the operation is completed successfully click Finish.

Joe Sixpack’s mailbox that was in the backup set is now saved in the .PST file on local disk. This .PST file can be handed over to the legal department for further investigation while Joe Sixpack never noticed anything about the whole operation.

Recovery Storage Group in Exchange Server 2007

The Recovery Storage Group functionality is also implemented in Exchange Server 2007, but it is not available through the default Exchange Management Console interface. To perform all operations with a Recovery Storage Group the Exchange Management Shell needs to be used. You can use some Recovery Storage Group functionality using the toolbox in the Exchange Management Console; I will explain this later in this article.

Open the Exchange Management Shell and enter the New-StorageGroup command. Make sure that you use the
–Recovery option, otherwise you’ll create a regular Storage Group:

Now create the Database in using the New-MailboxDatabase cmdlet. This database has the same name as the original mailbox database that contains Joe Sixpack’s mailbox:

The newly created database in the Recovery Storage Group should have the ability to be overwritten by a restore, so set this property:

Before the database can be mounted, the database should be restored from the backup set. When a Recovery Storage Group is created the restore is automatically redirected to the Recovery Storage Group by the Information Store, just like in Exchange Server 2003. Restore the database using your backup application.

When the database is restored into the Recovery Storage Group directory on the disk the database can be mounted:

Now the Recovery Storage Group is created, the mailbox database is created, restored from the backup set and mounted. It is still invisible to the end users and no one except the administrator can access the mailbox database in the Recovery Storage Group. Please remember that it is only accessible through the Management Shell, so colleagues using the regular Exchange Management Console also do not notice anything.

There is a thing you have to know though. In the Exchange Management Console you can go to the Toolbox and enter the “Database Recovery Management”.  From there there’s also the possibility to manage the Recovery Storage Group. The following tasks are available in the “Manage Recovery Storage Group” area:

• Merge or copy mailbox contents;
• Mount or dismount databases in the Recovery Storage Group;
• Remove the Recovery Storage Group;
• Set up “Database can be overwritten by restore” flag;
• Swap databases for “dial tone” scenario.

When the database is mounted the database statistics can be requested of the database in the Recovery Storage Group with the Get-MailboxStatistics cmdlet. These are disconnected mailboxes and are unknown to Active Directory. As far as Active Directory is concerned the actual mailboxes are located in the “mailbox database.edb” in the First Storage Group. Joe Sixpack’s mailbox is clearly visible.

Exchange Server 2007 SP1 has a new cmdlet to export data to a .PST file and as such the successor of EXMERGE that was used in Exchange Server 2003 and earlier. There are a few caveats with the Export-Mailbox cmdlet:

• to use this cmdlet Outlook 2003 SP2 (or higher) has to be installed on the server where the cmdlet is run. This can be a management workstation (or a management server) with only the Exchange Management Tools installed. It should also be a 32-bits server since the 64-bits Exchange Management Tools cannot cooperate with the 32-bits Outlook client software.
• To Export-Mailbox cmdlet runs only against a normal Exchange Server 2007 SP1 database and not against databases running in the Recovery Storage Group.

To overcome the second limitation a special “recovery mailbox” can be created in an ordinary Storage Group. When this mailbox is created the contents of Joe Sixpack’s mailbox can be restored into this recovery mailbox:

When the Restore Mailbox operation is running a progress bar is shown.

Figure:5. The progress bar shown during the Recover Maillbox operation

When the Restore Mailbox operation is finished the contents of Joe Sixpack’s mailbox is available in the Recovery Mailbox. When using Outlook to access this mailbox the contents is available in the \Recover folder in the mailbox. The \Recover folder in the Recovery Mailbox can be exported using Outlook, in the File menu select the “Import and Export option” and then select “Export to a file”. Follow the wizard to complete the export to a .PST file.

When Outlook 2003 SP2 (or higher) is installed on the Management Server the Export Mailbox cmdlet can also be used:

This will export the contents of the \Recover folder, and therefore the recovered mailbox from Joe Sixpack to a .PST file in the c:\temp directory on the local disk.

Figure:6. The Contents of the \Recovery folder and therefore of Joe Sxipack's mailbox. Joe Sixpack indeed sent out sensitive information

Recover Mailbox Data

Another interesting feature of the Recovery Storage Group is to recover deleted mailbox data. Suppose a user named Joel accidentally deleted important items from his mailbox and he is unable to retrieve this using the “recover deleted items” option in Outlook.

To solve this problem please restore the database that holds Joel’s mailbox data into the Recovery Storage Group. In Exchange Server 2003 in the Exchange System Manager go to the Recovery Storage Group and check Joel’s mailbox. A disconnected mailbox should be visible. Right Click the mailbox and select “Exchange tasks”.

Figure:7. Select Exchange Tasks in the Recovery Storage Group to restore mailbox data

After selecting Exchange Tasks please select “Recover Mailbox Data” (the only option available) and select the destination mailbox store. This should be the database that hold Joel’s mailbox, in this case the “Mailbox Store (2003SRVR)” in the First Storage Group.

Now you have to options to continue:

• Merge Data – when you select “Merge Data” the data from the mailbox copy in the Recovery Storage Group will be merged into the original data. If any item exists it will be detected and not be overwritten. Items that no longer exist (i.e., that have been deleted) will be recreated during the merge process;
• Copy Data – when you select “Copy Data” the data from the mailbox copy in the Recovery Storage Group will be copied to a separate location, i.e. a special folder named “Recovered Data” followed with the data and time of the recovery process in the user’s mailbox.

Figure:8. Merge the data into the mailbox or copy it to a "recovered items" folder in the user's mailbox

When finished you have recovered the mailbox data from the backup that’s in the Recovery Storage Group into the user’s mailbox.

When using Exchange Server 2007 you have to use the Exchange Management Shell or the Database Recovery Management in the Tools option in the Exchange Management Console.

Again, restore the database that holds Joel’s mailbox into the Recovery Storage Group. After restoring you can use the Restore-Mailbox cmdlet in the Exchange Management Console to restore the content to Joel’s mailbox.

You can also use the Exchange Management Console to recover mailbox items to Joel’s mailbox.

1. In the left-hand pane in the Exchange Management Console select the Tools option and in the middle pane select “Database Recovery Management” under “Disaster Recovery Tools”;
2. If needed enter the Exchange Server’s name and the Domain Controller’s name. Click Next to continue;
3. After a couple of seconds some tasks are shown. Select the “Merge or Copy contents” task;
4. The next window shows what database is mounted in the Recovery Storage Group; this is the Mailbox Database that was restored earlier. Click “Gather Merge Information” to continue;
5. Select “Perform pre-migration tasks” to continue. If the database in the Recovery Storage Group contains a lot of mailboxes you can select “Show Advanced Options” first to set a filter to narrow the selection;
6. In the “Select Mailboxes to Copy or Merge” windows select the mailbox that needs to be restored, in this example Joel Olson’s mailbox;
7. Click “Perform merge actions” to continue;
8. When finished the mailbox data have been restored to their original location.
    

Figure:9. Select the mailbox that needs to be restored.

Conclusion

When you need to retrieve a mailbox or mailbox content from a backup set the Recovery Storage Group is a great tool to use. Depending on the task, you have to perform everything in the Exchange Management Console or you may need to perform some actions in the Exchange Management Shell.

In both Exchange Server 2003 as well as Exchange Server 2007 it is possible to create a .PST file from a restored mailbox, but in Exchange Server 2007 it’s a bit more confusing because of the usage of the Exchange Management Shell.

Before you can efficiently use the Recovery Storage Group and its purposes I would advice to try it a couple of times, to see in what scenario’s it can help you in your day-to-day Exchange Management tasks. Make sure that you document all steps very well. In this case you know exactly what steps to perform when a request is made to restore a single mailbox, either to its original location or to a .PST file.